################################################################ # abuse.ch URLhaus IDS ruleset (Snort / Suricata) # # Last updated: 2026-10-16 13:47:06 (UTC) # # # # Terms Of Use: https://urlhaus.abuse.ch/api/ # # For questions please contact urlhaus [at] abuse.ch # ################################################################ # # url alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950935)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.155.202.252"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950935/; classtype:trojan-activity;sid:84814035; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950934)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"103.19.49.134"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950934/; classtype:trojan-activity;sid:84814034; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950933)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.235.91.212"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950933/; classtype:trojan-activity;sid:84814033; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950932)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.237.44.123"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950932/; classtype:trojan-activity;sid:84814032; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950930)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.23.179.155"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950930/; classtype:trojan-activity;sid:84814030; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950931)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.214.241.229"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950931/; classtype:trojan-activity;sid:84814031; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950929)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.8.57.120"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950929/; classtype:trojan-activity;sid:84814029; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950928)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.97.250.175"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950928/; classtype:trojan-activity;sid:84814028; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950927)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.96.142.200"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950927/; classtype:trojan-activity;sid:84814027; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950926)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.146.210.83"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950926/; classtype:trojan-activity;sid:84814026; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950924)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"79.40.9.54"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950924/; classtype:trojan-activity;sid:84814024; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950923)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.116.15.211"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950923/; classtype:trojan-activity;sid:84814023; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950922)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"82.114.178.6"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950922/; classtype:trojan-activity;sid:84814022; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950921)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1519428468599951424/1560609388643749898/bundle_2.zip|3f|ex=6ad35640|7c|26|7c|is=6ad204c0|7c|26|7c|hm=cb9fbf17c2878b6412f8eefc3829665eefecdf4b00da43aea25530480fc6c64e|7c|26|7c|"; http_uri; depth:188; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950921/; classtype:trojan-activity;sid:84814021; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950920)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"117.40.68.183"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950920/; classtype:trojan-activity;sid:84814020; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950917)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"83.228.109.209"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950917/; classtype:trojan-activity;sid:84814017; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950918)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"178.141.18.236"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950918/; classtype:trojan-activity;sid:84814018; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950916)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"58.208.136.102"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950916/; classtype:trojan-activity;sid:84814016; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950915)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.173.80.97"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950915/; classtype:trojan-activity;sid:84814015; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950913)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"103.19.49.134"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950913/; classtype:trojan-activity;sid:84814013; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950912)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"180.149.219.213"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950912/; classtype:trojan-activity;sid:84814012; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950911)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1547710119960252437/1560338083763986483/bundle.zip|3f|ex=6ad25994|7c|26|7c|is=6ad10814|7c|26|7c|hm=f4a36d7a4f14fb8800499fa9fffeb8b082cf2127db775c601dec42b49a573474|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950911/; classtype:trojan-activity;sid:84814011; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950910)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1559223274288713738/1560457391433060432/bundle.zip|3f|ex=6ad2c8b2|7c|26|7c|is=6ad17732|7c|26|7c|hm=8ff43d5336ebb70a80c7f9de77aa39606c42d7955178679b375d3b4fca33ad06|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950910/; classtype:trojan-activity;sid:84814010; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950909)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1558584819267412038/1560294290767478965/bundle.zip|3f|ex=6ad230cb|7c|26|7c|is=6ad0df4b|7c|26|7c|hm=1bb32a99846de97b638781c36dafa178727d543eeb9f1d5185b834464f480fd4|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950909/; classtype:trojan-activity;sid:84814009; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950908)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1557740644179517531/1560598231719743639/bundle.zip|3f|ex=6ad34bdc|7c|26|7c|is=6ad1fa5c|7c|26|7c|hm=ba7473688cdaf3172f3046c5a553fdfdf74a4c0e8ad527f9d95f1a2d0fbbad87|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950908/; classtype:trojan-activity;sid:84814008; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950905)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"37.34.181.111"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950905/; classtype:trojan-activity;sid:84814005; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950906)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"220.191.125.250"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950906/; classtype:trojan-activity;sid:84814006; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950907)"; flow:established,from_client; content:"GET"; http_method; content:"/new.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"23.160.56.223"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950907/; classtype:trojan-activity;sid:84814007; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950904)"; flow:established,from_client; content:"GET"; http_method; content:"/mina.jar"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"tribot.co.uk"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950904/; classtype:trojan-activity;sid:84814004; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950899)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.238.139.12"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950899/; classtype:trojan-activity;sid:84813999; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950898)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.237.44.123"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950898/; classtype:trojan-activity;sid:84813998; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950897)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"41.248.22.74"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950897/; classtype:trojan-activity;sid:84813997; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950896)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"103.126.201.130"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950896/; classtype:trojan-activity;sid:84813996; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950894)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.141.74.123"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950894/; classtype:trojan-activity;sid:84813994; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950895)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.14.17.75"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950895/; classtype:trojan-activity;sid:84813995; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950891)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.142.221.213"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950891/; classtype:trojan-activity;sid:84813991; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950892)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.127.60.98"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950892/; classtype:trojan-activity;sid:84813992; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950893)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.184.76.124"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950893/; classtype:trojan-activity;sid:84813993; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950889)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"218.61.29.103"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950889/; classtype:trojan-activity;sid:84813989; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950890)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.61.115.242"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950890/; classtype:trojan-activity;sid:84813990; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950888)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.117.119.237"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950888/; classtype:trojan-activity;sid:84813988; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950887)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"218.61.29.103"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950887/; classtype:trojan-activity;sid:84813987; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950886)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.127.111.173"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950886/; classtype:trojan-activity;sid:84813986; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950885)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"105.225.25.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950885/; classtype:trojan-activity;sid:84813985; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950884)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"219.155.202.252"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950884/; classtype:trojan-activity;sid:84813984; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950883)"; flow:established,from_client; content:"GET"; http_method; content:"/f/zh2s2xptaamrnzpdyiq0ng/vj1ury4s"; http_uri; depth:34; isdataat:!1,relative; nocase; content:"haven-post.com"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950883/; classtype:trojan-activity;sid:84813983; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950876)"; flow:established,from_client; content:"GET"; http_method; content:"/x86"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"45.135.193.209"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950876/; classtype:trojan-activity;sid:84813976; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950875)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.184.168.190"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950875/; classtype:trojan-activity;sid:84813975; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950873)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.238.139.238"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950873/; classtype:trojan-activity;sid:84813973; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950874)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.239.231.145"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950874/; classtype:trojan-activity;sid:84813974; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950872)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.227.203.38"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950872/; classtype:trojan-activity;sid:84813972; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950870)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.224.10.16"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950870/; classtype:trojan-activity;sid:84813970; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950867)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.51.92.255"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950867/; classtype:trojan-activity;sid:84813967; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950866)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.184.120.172"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950866/; classtype:trojan-activity;sid:84813966; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950865)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"138.204.196.244"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950865/; classtype:trojan-activity;sid:84813965; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950864)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.234.167.165"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950864/; classtype:trojan-activity;sid:84813964; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950863)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"171.213.198.0"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950863/; classtype:trojan-activity;sid:84813963; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950861)"; flow:established,from_client; content:"GET"; http_method; content:"/suzxwgr/afwugem/aimxfrz/desecured_stub.ps1"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"vtivision-fi.com"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950861/; classtype:trojan-activity;sid:84813961; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950862)"; flow:established,from_client; content:"GET"; http_method; content:"/suzxwgr/afwugem/aimxfrz/ugtsecured_stub.ps1"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"vtivision-fi.com"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950862/; classtype:trojan-activity;sid:84813962; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950858)"; flow:established,from_client; content:"GET"; http_method; content:"/suzxwgr/afwugem/aimxfrz/kpsecured_stub.ps1"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"vtivision-fi.com"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950858/; classtype:trojan-activity;sid:84813958; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950855)"; flow:established,from_client; content:"GET"; http_method; content:"/uc|3f|export=download|7c|26|7c|id=1zejspywgejar5gtqviaokk7cxyia7xwy"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"drive.google.com"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950855/; classtype:trojan-activity;sid:84813955; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950854)"; flow:established,from_client; content:"GET"; http_method; content:"/uc|3f|export=download|7c|26|7c|id=10icemtxdkr_yogc4nzidkbkzowjddq22"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"drive.google.com"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950854/; classtype:trojan-activity;sid:84813954; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950852)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.149.85.227"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950852/; classtype:trojan-activity;sid:84813952; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950851)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.228.247.58"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950851/; classtype:trojan-activity;sid:84813951; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950847)"; flow:established,from_client; content:"GET"; http_method; content:"/riscv64"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950847/; classtype:trojan-activity;sid:84813947; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950848)"; flow:established,from_client; content:"GET"; http_method; content:"/ppc64le"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950848/; classtype:trojan-activity;sid:84813948; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950849)"; flow:established,from_client; content:"GET"; http_method; content:"/mipsle"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950849/; classtype:trojan-activity;sid:84813949; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950850)"; flow:established,from_client; content:"GET"; http_method; content:"/s390x"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950850/; classtype:trojan-activity;sid:84813950; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950840)"; flow:established,from_client; content:"GET"; http_method; content:"/armv6"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950840/; classtype:trojan-activity;sid:84813940; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950841)"; flow:established,from_client; content:"GET"; http_method; content:"/amd64"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950841/; classtype:trojan-activity;sid:84813941; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950842)"; flow:established,from_client; content:"GET"; http_method; content:"/armhf"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950842/; classtype:trojan-activity;sid:84813942; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950843)"; flow:established,from_client; content:"GET"; http_method; content:"/arm64"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950843/; classtype:trojan-activity;sid:84813943; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950844)"; flow:established,from_client; content:"GET"; http_method; content:"/mips64el"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950844/; classtype:trojan-activity;sid:84813944; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950845)"; flow:established,from_client; content:"GET"; http_method; content:"/armv7"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950845/; classtype:trojan-activity;sid:84813945; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950846)"; flow:established,from_client; content:"GET"; http_method; content:"/mipsel"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950846/; classtype:trojan-activity;sid:84813946; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950838)"; flow:established,from_client; content:"GET"; http_method; content:"/arm"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950838/; classtype:trojan-activity;sid:84813938; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950839)"; flow:established,from_client; content:"GET"; http_method; content:"/x86_64"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950839/; classtype:trojan-activity;sid:84813939; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950837)"; flow:established,from_client; content:"GET"; http_method; content:"/aarch64"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950837/; classtype:trojan-activity;sid:84813937; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950836)"; flow:established,from_client; content:"GET"; http_method; content:"/mips"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950836/; classtype:trojan-activity;sid:84813936; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950832)"; flow:established,from_client; content:"GET"; http_method; content:"/i386"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950832/; classtype:trojan-activity;sid:84813932; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950833)"; flow:established,from_client; content:"GET"; http_method; content:"/mips64le"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950833/; classtype:trojan-activity;sid:84813933; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950834)"; flow:established,from_client; content:"GET"; http_method; content:"/ppc64"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950834/; classtype:trojan-activity;sid:84813934; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950835)"; flow:established,from_client; content:"GET"; http_method; content:"/mips64"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950835/; classtype:trojan-activity;sid:84813935; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950831)"; flow:established,from_client; content:"GET"; http_method; content:"/x86"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950831/; classtype:trojan-activity;sid:84813931; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950820)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.156.116.253"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950820/; classtype:trojan-activity;sid:84813920; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950821)"; flow:established,from_client; content:"GET"; http_method; content:"/linux"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"8.166.135.58"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950821/; classtype:trojan-activity;sid:84813921; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950819)"; flow:established,from_client; content:"GET"; http_method; content:"/trackspeed/temp-spoofer-lifetime/-/raw/head/temp-spoofer.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950819/; classtype:trojan-activity;sid:84813919; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950814)"; flow:established,from_client; content:"GET"; http_method; content:"/youngbro/fivem-external-cheat/-/raw/head/loader.exe"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950814/; classtype:trojan-activity;sid:84813914; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950815)"; flow:established,from_client; content:"GET"; http_method; content:"/ohebert1998/trx-drainer-tool/releases/download/trx-drainer-tool/trx-drainer-tool.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950815/; classtype:trojan-activity;sid:84813915; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950816)"; flow:established,from_client; content:"GET"; http_method; content:"/rickychainz/redengine-fivem/-/raw/head/loader.exe"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950816/; classtype:trojan-activity;sid:84813916; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950817)"; flow:established,from_client; content:"GET"; http_method; content:"/purematch/genshin-impact-private-cheat-with-spoofer/-/raw/head/akebigc.exe"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950817/; classtype:trojan-activity;sid:84813917; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950810)"; flow:established,from_client; content:"GET"; http_method; content:"/savagemint7/tonkeeper-fake-balance/releases/download/tonkeeper-fake-balance/tonkeeper-fake-balance.rar"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950810/; classtype:trojan-activity;sid:84813910; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950811)"; flow:established,from_client; content:"GET"; http_method; content:"/tpatberg14/solana-drainer-tool/releases/download/solana-drainer-tool/solana-drainer-tool.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950811/; classtype:trojan-activity;sid:84813911; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950813)"; flow:established,from_client; content:"GET"; http_method; content:"/shawtycash/quantv-sp-fivem-ragemp-altv/-/raw/head/quantv_latest_2026.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950813/; classtype:trojan-activity;sid:84813913; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950808)"; flow:established,from_client; content:"GET"; http_method; content:"/hangwheels/fluxus-executor/-/raw/head/fluxusexecutor.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950808/; classtype:trojan-activity;sid:84813908; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950809)"; flow:established,from_client; content:"GET"; http_method; content:"/lifechange/monotone-hwid-spoofer/-/raw/head/monotone-hwid-spoofer-master.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950809/; classtype:trojan-activity;sid:84813909; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950807)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"219.155.221.103"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950807/; classtype:trojan-activity;sid:84813907; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950806)"; flow:established,from_client; content:"GET"; http_method; content:"/k.php|3f|a=x86_64,u918p20909nfp14th"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"45.87.174.8"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950806/; classtype:trojan-activity;sid:84813906; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950800)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"105.225.99.51"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950800/; classtype:trojan-activity;sid:84813900; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950801)"; flow:established,from_client; content:"GET"; http_method; content:"/pverhoeven74/crypto-clipper/releases/download/crypto-clipper/crypto-clipper.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950801/; classtype:trojan-activity;sid:84813901; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950802)"; flow:established,from_client; content:"GET"; http_method; content:"/romanzhukov9/crypto-recovery-tool/releases/download/crypto-recovery-tool/crypto-recovery-tool.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950802/; classtype:trojan-activity;sid:84813902; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950803)"; flow:established,from_client; content:"GET"; http_method; content:"/guenter22/flash-usdt-tool/releases/download/flash-usdt-tool/flash-usdt-tool.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950803/; classtype:trojan-activity;sid:84813903; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950804)"; flow:established,from_client; content:"GET"; http_method; content:"/ankitapham1993/electrum-fake-balance/releases/download/electrum-fake-balance/electrum-fake-balance.rar"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950804/; classtype:trojan-activity;sid:84813904; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950799)"; flow:established,from_client; content:"GET"; http_method; content:"/twobitss/solaraexecutor/-/raw/head/solaraexecutor.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950799/; classtype:trojan-activity;sid:84813899; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950793)"; flow:established,from_client; content:"GET"; http_method; content:"/mods/larpclient-1.21.11.jar"; http_uri; depth:28; isdataat:!1,relative; nocase; content:"mc-modhub.vercel.app"; http_host; depth:20; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950793/; classtype:trojan-activity;sid:84813893; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950794)"; flow:established,from_client; content:"GET"; http_method; content:"/contimillsy/warzone-dominator/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950794/; classtype:trojan-activity;sid:84813894; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950795)"; flow:established,from_client; content:"GET"; http_method; content:"/errinysh/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950795/; classtype:trojan-activity;sid:84813895; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950796)"; flow:established,from_client; content:"GET"; http_method; content:"/contimaxxes/xeno-executor/head/xeno.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950796/; classtype:trojan-activity;sid:84813896; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950797)"; flow:established,from_client; content:"GET"; http_method; content:"/criellims/swift-executor/head/swift.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950797/; classtype:trojan-activity;sid:84813897; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950798)"; flow:established,from_client; content:"GET"; http_method; content:"/arekillesy/pubg-desync-menu/head/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950798/; classtype:trojan-activity;sid:84813898; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950791)"; flow:established,from_client; content:"GET"; http_method; content:"/filegoodls/valorantexternalcheat/head/loader.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950791/; classtype:trojan-activity;sid:84813891; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950792)"; flow:established,from_client; content:"GET"; http_method; content:"/hamm1lts/skriptgg/head/skriptgg.exe"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950792/; classtype:trojan-activity;sid:84813892; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950784)"; flow:established,from_client; content:"GET"; http_method; content:"/mods/goobaaclient-1.21.11.jar"; http_uri; depth:30; isdataat:!1,relative; nocase; content:"mc-modhub.vercel.app"; http_host; depth:20; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950784/; classtype:trojan-activity;sid:84813884; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950782)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1559223274288713738/1560413897264078999/bundle.zip|3f|ex=6ad2a030|7c|26|7c|is=6ad14eb0|7c|26|7c|hm=c192b9c1098852aa281c9cc458951c571334a88dcd20020edccbb502fc13bc07|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950782/; classtype:trojan-activity;sid:84813882; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950783)"; flow:established,from_client; content:"GET"; http_method; content:"/acelucky/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/head/eft_hack.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950783/; classtype:trojan-activity;sid:84813883; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950780)"; flow:established,from_client; content:"GET"; http_method; content:"/mods/orchardclient-1.21.11.jar"; http_uri; depth:31; isdataat:!1,relative; nocase; content:"mc-modhub.vercel.app"; http_host; depth:20; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950780/; classtype:trojan-activity;sid:84813880; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950781)"; flow:established,from_client; content:"GET"; http_method; content:"/mods/krispyclient-1.21.11.jar"; http_uri; depth:30; isdataat:!1,relative; nocase; content:"mc-modhub.vercel.app"; http_host; depth:20; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950781/; classtype:trojan-activity;sid:84813881; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950779)"; flow:established,from_client; content:"GET"; http_method; content:"/mods/grimclient-1.21.11.jar"; http_uri; depth:28; isdataat:!1,relative; nocase; content:"mc-modhub.vercel.app"; http_host; depth:20; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950779/; classtype:trojan-activity;sid:84813879; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950777)"; flow:established,from_client; content:"GET"; http_method; content:"/2026scrill/client.jar"; http_uri; depth:22; isdataat:!1,relative; nocase; content:"runelite.cc"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950777/; classtype:trojan-activity;sid:84813877; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950773)"; flow:established,from_client; content:"GET"; http_method; content:"/mods/dqrkisclient-1.21.11.jar"; http_uri; depth:30; isdataat:!1,relative; nocase; content:"mc-modhub.vercel.app"; http_host; depth:20; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950773/; classtype:trojan-activity;sid:84813873; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950774)"; flow:established,from_client; content:"GET"; http_method; content:"/mods/67client-1.21.11.jar"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"mc-modhub.vercel.app"; http_host; depth:20; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950774/; classtype:trojan-activity;sid:84813874; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950775)"; flow:established,from_client; content:"GET"; http_method; content:"/mods/clarityclient-26.1.2.jar"; http_uri; depth:30; isdataat:!1,relative; nocase; content:"mc-modhub.vercel.app"; http_host; depth:20; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950775/; classtype:trojan-activity;sid:84813875; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950776)"; flow:established,from_client; content:"GET"; http_method; content:"/mods/4eclient-1.21.jar"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"mc-modhub.vercel.app"; http_host; depth:20; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950776/; classtype:trojan-activity;sid:84813876; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950771)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"219.156.116.253"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950771/; classtype:trojan-activity;sid:84813871; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950770)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.113.209.143"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950770/; classtype:trojan-activity;sid:84813870; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950769)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.56.103.148"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950769/; classtype:trojan-activity;sid:84813869; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950768)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"116.140.142.13"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950768/; classtype:trojan-activity;sid:84813868; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950767)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"210.208.110.20"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950767/; classtype:trojan-activity;sid:84813867; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950766)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.58.124.116"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950766/; classtype:trojan-activity;sid:84813866; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950765)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"180.131.167.125"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950765/; classtype:trojan-activity;sid:84813865; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950762)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.113.209.143"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950762/; classtype:trojan-activity;sid:84813862; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950761)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.155.221.103"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950761/; classtype:trojan-activity;sid:84813861; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950760)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.227.206.252"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950760/; classtype:trojan-activity;sid:84813860; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950759)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.235.91.212"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950759/; classtype:trojan-activity;sid:84813859; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950758)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"203.160.9.182"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950758/; classtype:trojan-activity;sid:84813858; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950756)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"61.53.84.98"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950756/; classtype:trojan-activity;sid:84813856; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950755)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"183.151.200.30"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950755/; classtype:trojan-activity;sid:84813855; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950750)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"210.208.110.51"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950750/; classtype:trojan-activity;sid:84813850; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950749)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"220.168.238.209"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950749/; classtype:trojan-activity;sid:84813849; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950748)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.137.141.44"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950748/; classtype:trojan-activity;sid:84813848; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950747)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.119.34.156"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950747/; classtype:trojan-activity;sid:84813847; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950746)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.119.34.156"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950746/; classtype:trojan-activity;sid:84813846; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950743)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.202.234.23"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950743/; classtype:trojan-activity;sid:84813843; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950744)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"221.202.234.23"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950744/; classtype:trojan-activity;sid:84813844; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950742)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.113.205.239"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950742/; classtype:trojan-activity;sid:84813842; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950741)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arm5"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"38.43.93.61"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950741/; classtype:trojan-activity;sid:84813841; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950737)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.spc"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"91.92.43.221"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950737/; classtype:trojan-activity;sid:84813837; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950738)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.x86"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"38.43.93.61"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950738/; classtype:trojan-activity;sid:84813838; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950739)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.mips"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"38.43.93.61"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950739/; classtype:trojan-activity;sid:84813839; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950740)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.x86_64"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"38.43.93.61"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950740/; classtype:trojan-activity;sid:84813840; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950732)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.ppc"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"38.43.93.61"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950732/; classtype:trojan-activity;sid:84813832; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950733)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arm7"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"38.43.93.61"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950733/; classtype:trojan-activity;sid:84813833; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950734)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.mpsl"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"38.43.93.61"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950734/; classtype:trojan-activity;sid:84813834; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950735)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.sh4"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"38.43.93.61"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950735/; classtype:trojan-activity;sid:84813835; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950736)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.m68k"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"38.43.93.61"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950736/; classtype:trojan-activity;sid:84813836; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950731)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.230.54.62"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950731/; classtype:trojan-activity;sid:84813831; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950730)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.55.37.135"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950730/; classtype:trojan-activity;sid:84813830; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950729)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.15.189.37"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950729/; classtype:trojan-activity;sid:84813829; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950728)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"180.190.200.74"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950728/; classtype:trojan-activity;sid:84813828; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950726)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.174.13.217"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950726/; classtype:trojan-activity;sid:84813826; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950727)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"178.207.243.137"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950727/; classtype:trojan-activity;sid:84813827; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950725)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.140.182.253"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950725/; classtype:trojan-activity;sid:84813825; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950723)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"180.244.225.170"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950723/; classtype:trojan-activity;sid:84813823; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950724)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.113.205.239"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950724/; classtype:trojan-activity;sid:84813824; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950719)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.121.213.133"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950719/; classtype:trojan-activity;sid:84813819; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950720)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.113.34.105"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950720/; classtype:trojan-activity;sid:84813820; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950721)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.113.0.7"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950721/; classtype:trojan-activity;sid:84813821; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950718)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.140.182.253"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950718/; classtype:trojan-activity;sid:84813818; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950715)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.231.249.63"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950715/; classtype:trojan-activity;sid:84813815; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950714)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.239.231.217"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950714/; classtype:trojan-activity;sid:84813814; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950713)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.42.225.92"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950713/; classtype:trojan-activity;sid:84813813; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950711)"; flow:established,from_client; content:"GET"; http_method; content:"/microsoft_store/download/version/93.11.1/2fa_code_engine.exe"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"dir.sonikjp.org"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950711/; classtype:trojan-activity;sid:84813811; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950710)"; flow:established,from_client; content:"GET"; http_method; content:"/download/version/15.12.16/qr2auth.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"ww.menara5d.net"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950710/; classtype:trojan-activity;sid:84813810; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950706)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.239.231.217"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_16; reference:url, urlhaus.abuse.ch/url/3950706/; classtype:trojan-activity;sid:84813806; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950705)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.50.89.97"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950705/; classtype:trojan-activity;sid:84813805; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950704)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.61.118.122"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950704/; classtype:trojan-activity;sid:84813804; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950703)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.227.207.135"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950703/; classtype:trojan-activity;sid:84813803; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950702)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.15.178.114"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950702/; classtype:trojan-activity;sid:84813802; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950701)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"124.92.76.80"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950701/; classtype:trojan-activity;sid:84813801; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950700)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.234.233.113"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950700/; classtype:trojan-activity;sid:84813800; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950699)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.238.139.238"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950699/; classtype:trojan-activity;sid:84813799; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950698)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.50.89.97"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950698/; classtype:trojan-activity;sid:84813798; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950697)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.62.117.230"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950697/; classtype:trojan-activity;sid:84813797; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950696)"; flow:established,from_client; content:"GET"; http_method; content:"/download/version/15.12.16/qr2auth.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"brotherspizzapeoria.com"; http_host; depth:23; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950696/; classtype:trojan-activity;sid:84813796; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950695)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.55.53.145"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950695/; classtype:trojan-activity;sid:84813795; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950694)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.15.173.51"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950694/; classtype:trojan-activity;sid:84813794; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950693)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.49.24.236"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950693/; classtype:trojan-activity;sid:84813793; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950692)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.225.99.51"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950692/; classtype:trojan-activity;sid:84813792; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950691)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.133.30.139"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950691/; classtype:trojan-activity;sid:84813791; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950690)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.177.21.160"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950690/; classtype:trojan-activity;sid:84813790; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950689)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.49.69.231"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950689/; classtype:trojan-activity;sid:84813789; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950688)"; flow:established,from_client; content:"GET"; http_method; content:"/microsoft_store/download/version/93.11.1/2fa_code_engine.exe"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"anthonyspizzeriainc.com"; http_host; depth:23; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950688/; classtype:trojan-activity;sid:84813788; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950686)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.13.52.10"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950686/; classtype:trojan-activity;sid:84813786; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950687)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.13.52.10"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950687/; classtype:trojan-activity;sid:84813787; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950685)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"36.32.176.115"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950685/; classtype:trojan-activity;sid:84813785; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950684)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.157.186.140"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950684/; classtype:trojan-activity;sid:84813784; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950683)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"113.236.92.29"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950683/; classtype:trojan-activity;sid:84813783; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950682)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.127.111.173"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950682/; classtype:trojan-activity;sid:84813782; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950681)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"114.228.131.9"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950681/; classtype:trojan-activity;sid:84813781; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950680)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"219.157.186.140"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950680/; classtype:trojan-activity;sid:84813780; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950679)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.230.42.54"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950679/; classtype:trojan-activity;sid:84813779; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950678)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.42.32.7"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950678/; classtype:trojan-activity;sid:84813778; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950677)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"124.94.170.244"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950677/; classtype:trojan-activity;sid:84813777; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950676)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.97.248.127"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950676/; classtype:trojan-activity;sid:84813776; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950675)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"45.166.188.48"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950675/; classtype:trojan-activity;sid:84813775; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950674)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.230.42.54"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950674/; classtype:trojan-activity;sid:84813774; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950673)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"117.131.92.150"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950673/; classtype:trojan-activity;sid:84813773; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950672)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"106.58.126.200"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950672/; classtype:trojan-activity;sid:84813772; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950671)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"220.191.125.250"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950671/; classtype:trojan-activity;sid:84813771; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950670)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.15.185.193"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950670/; classtype:trojan-activity;sid:84813770; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950669)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.214.181.197"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950669/; classtype:trojan-activity;sid:84813769; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950668)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.61.118.122"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950668/; classtype:trojan-activity;sid:84813768; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950667)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.121.213.133"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950667/; classtype:trojan-activity;sid:84813767; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950666)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"101.109.199.229"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950666/; classtype:trojan-activity;sid:84813766; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950660)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.113.34.105"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950660/; classtype:trojan-activity;sid:84813760; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950661)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.121.85.243"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950661/; classtype:trojan-activity;sid:84813761; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950662)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.122.233.48"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950662/; classtype:trojan-activity;sid:84813762; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950663)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.57.180.160"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950663/; classtype:trojan-activity;sid:84813763; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950664)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.225.25.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950664/; classtype:trojan-activity;sid:84813764; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950665)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.57.180.160"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950665/; classtype:trojan-activity;sid:84813765; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950659)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.55.192.158"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950659/; classtype:trojan-activity;sid:84813759; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950658)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"223.151.72.37"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950658/; classtype:trojan-activity;sid:84813758; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950657)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.221.145.214"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950657/; classtype:trojan-activity;sid:84813757; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950656)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.55.192.158"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950656/; classtype:trojan-activity;sid:84813756; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950655)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"196.221.145.214"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950655/; classtype:trojan-activity;sid:84813755; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950654)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"116.139.137.227"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950654/; classtype:trojan-activity;sid:84813754; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950652)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.12.234.123"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950652/; classtype:trojan-activity;sid:84813752; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950653)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.28.194.92"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950653/; classtype:trojan-activity;sid:84813753; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950651)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.116.112.212"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950651/; classtype:trojan-activity;sid:84813751; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950650)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arm"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"melonandworld.top"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950650/; classtype:trojan-activity;sid:84813750; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950649)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"111.179.145.25"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950649/; classtype:trojan-activity;sid:84813749; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950648)"; flow:established,from_client; content:"GET"; http_method; content:"/1.sh"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"melonandworld.top"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950648/; classtype:trojan-activity;sid:84813748; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950646)"; flow:established,from_client; content:"GET"; http_method; content:"/1.sh"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"scribblebubblebibi.top"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950646/; classtype:trojan-activity;sid:84813746; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950647)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.21.43.36"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950647/; classtype:trojan-activity;sid:84813747; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950645)"; flow:established,from_client; content:"GET"; http_method; content:"/1.sh"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"steelstanleystaystrong.top"; http_host; depth:26; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950645/; classtype:trojan-activity;sid:84813745; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950644)"; flow:established,from_client; content:"GET"; http_method; content:"/jordfyldens.toc"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"griffcar.com.br"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950644/; classtype:trojan-activity;sid:84813744; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950642)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.a"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.234.145.4"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950642/; classtype:trojan-activity;sid:84813742; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950643)"; flow:established,from_client; content:"GET"; http_method; content:"/1.sh"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"plochcarsportsball.top"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950643/; classtype:trojan-activity;sid:84813743; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950641)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"110.138.8.251"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950641/; classtype:trojan-activity;sid:84813741; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950640)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.x86"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"melonandworld.top"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950640/; classtype:trojan-activity;sid:84813740; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950639)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arm7"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"plochcarsportsball.top"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950639/; classtype:trojan-activity;sid:84813739; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950638)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arm5"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"plochcarsportsball.top"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950638/; classtype:trojan-activity;sid:84813738; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950637)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.x86"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"plochcarsportsball.top"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950637/; classtype:trojan-activity;sid:84813737; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950633)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.x86"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"steelstanleystaystrong.top"; http_host; depth:26; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950633/; classtype:trojan-activity;sid:84813733; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950634)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arm"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"scribblebubblebibi.top"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950634/; classtype:trojan-activity;sid:84813734; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950635)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.i686"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"melonandworld.top"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950635/; classtype:trojan-activity;sid:84813735; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950636)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.sh4"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"scribblebubblebibi.top"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950636/; classtype:trojan-activity;sid:84813736; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950629)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.ppc"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"plochcarsportsball.top"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950629/; classtype:trojan-activity;sid:84813729; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950630)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.sh4"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"plochcarsportsball.top"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950630/; classtype:trojan-activity;sid:84813730; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950631)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arm6"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"plochcarsportsball.top"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950631/; classtype:trojan-activity;sid:84813731; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950632)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arc"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"steelstanleystaystrong.top"; http_host; depth:26; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950632/; classtype:trojan-activity;sid:84813732; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950627)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.i686"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"steelstanleystaystrong.top"; http_host; depth:26; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950627/; classtype:trojan-activity;sid:84813727; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950628)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.x86_64"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"scribblebubblebibi.top"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950628/; classtype:trojan-activity;sid:84813728; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950618)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.mips"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"melonandworld.top"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950618/; classtype:trojan-activity;sid:84813718; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950619)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.ppc"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"melonandworld.top"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950619/; classtype:trojan-activity;sid:84813719; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950620)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arm7"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"melonandworld.top"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950620/; classtype:trojan-activity;sid:84813720; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950621)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.mpsl"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"steelstanleystaystrong.top"; http_host; depth:26; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950621/; classtype:trojan-activity;sid:84813721; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950622)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arm6"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"steelstanleystaystrong.top"; http_host; depth:26; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950622/; classtype:trojan-activity;sid:84813722; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950623)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arm"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"plochcarsportsball.top"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950623/; classtype:trojan-activity;sid:84813723; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950624)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.mpsl"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"scribblebubblebibi.top"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950624/; classtype:trojan-activity;sid:84813724; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950625)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arc"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"melonandworld.top"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950625/; classtype:trojan-activity;sid:84813725; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950626)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arm6"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"melonandworld.top"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950626/; classtype:trojan-activity;sid:84813726; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950606)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.mips"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"steelstanleystaystrong.top"; http_host; depth:26; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950606/; classtype:trojan-activity;sid:84813706; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950607)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.mpsl"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"plochcarsportsball.top"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950607/; classtype:trojan-activity;sid:84813707; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950608)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arm7"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"scribblebubblebibi.top"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950608/; classtype:trojan-activity;sid:84813708; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950609)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.mips"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"plochcarsportsball.top"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950609/; classtype:trojan-activity;sid:84813709; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950610)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arm5"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"steelstanleystaystrong.top"; http_host; depth:26; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950610/; classtype:trojan-activity;sid:84813710; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950611)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.sh4"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"steelstanleystaystrong.top"; http_host; depth:26; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950611/; classtype:trojan-activity;sid:84813711; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950612)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.m68k"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"melonandworld.top"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950612/; classtype:trojan-activity;sid:84813712; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950613)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.x86_64"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"melonandworld.top"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950613/; classtype:trojan-activity;sid:84813713; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950614)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arc"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"plochcarsportsball.top"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950614/; classtype:trojan-activity;sid:84813714; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950615)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arm5"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"scribblebubblebibi.top"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950615/; classtype:trojan-activity;sid:84813715; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950616)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.sh4"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"melonandworld.top"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950616/; classtype:trojan-activity;sid:84813716; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950617)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.ppc"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"steelstanleystaystrong.top"; http_host; depth:26; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950617/; classtype:trojan-activity;sid:84813717; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950604)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.x86"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"scribblebubblebibi.top"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950604/; classtype:trojan-activity;sid:84813704; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950605)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.x86_64"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"steelstanleystaystrong.top"; http_host; depth:26; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950605/; classtype:trojan-activity;sid:84813705; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950603)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.x86_64"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"plochcarsportsball.top"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950603/; classtype:trojan-activity;sid:84813703; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950602)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.m68k"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"plochcarsportsball.top"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950602/; classtype:trojan-activity;sid:84813702; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950591)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arc"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"scribblebubblebibi.top"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950591/; classtype:trojan-activity;sid:84813691; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950592)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arm6"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"scribblebubblebibi.top"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950592/; classtype:trojan-activity;sid:84813692; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950593)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arm7"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"steelstanleystaystrong.top"; http_host; depth:26; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950593/; classtype:trojan-activity;sid:84813693; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950594)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.mpsl"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"melonandworld.top"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950594/; classtype:trojan-activity;sid:84813694; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950595)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.i686"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"scribblebubblebibi.top"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950595/; classtype:trojan-activity;sid:84813695; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950596)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.ppc"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"scribblebubblebibi.top"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950596/; classtype:trojan-activity;sid:84813696; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950597)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.m68k"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"steelstanleystaystrong.top"; http_host; depth:26; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950597/; classtype:trojan-activity;sid:84813697; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950598)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.mips"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"scribblebubblebibi.top"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950598/; classtype:trojan-activity;sid:84813698; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950599)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arm"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"steelstanleystaystrong.top"; http_host; depth:26; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950599/; classtype:trojan-activity;sid:84813699; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950600)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arm5"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"melonandworld.top"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950600/; classtype:trojan-activity;sid:84813700; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950601)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.i686"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"plochcarsportsball.top"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950601/; classtype:trojan-activity;sid:84813701; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950590)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.m68k"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"scribblebubblebibi.top"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950590/; classtype:trojan-activity;sid:84813690; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950589)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"112.248.245.25"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950589/; classtype:trojan-activity;sid:84813689; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950588)"; flow:established,from_client; content:"GET"; http_method; content:"/g84kfs5n/uploads/inject-test.exe_melted.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"109.238.87.75"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950588/; classtype:trojan-activity;sid:84813688; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950587)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1559223274288713738/1560345233772904488/bundle.zip|3f|ex=6ad2603d|7c|26|7c|is=6ad10ebd|7c|26|7c|hm=49c0bd69cb1ca8cd85c0689bd14ddb748734e4975b02953df8e0211a8995d347|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950587/; classtype:trojan-activity;sid:84813687; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950586)"; flow:established,from_client; content:"GET"; http_method; content:"/dvnx.zip"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"cdw.omsules.life"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950586/; classtype:trojan-activity;sid:84813686; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950585)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"139.227.137.155"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950585/; classtype:trojan-activity;sid:84813685; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950584)"; flow:established,from_client; content:"GET"; http_method; content:"/dvnx.zip"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"cdt.omsules.life"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950584/; classtype:trojan-activity;sid:84813684; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950583)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.227.196.224"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950583/; classtype:trojan-activity;sid:84813683; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950578)"; flow:established,from_client; content:"GET"; http_method; content:"/hunter"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"151.240.157.27"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950578/; classtype:trojan-activity;sid:84813678; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950579)"; flow:established,from_client; content:"GET"; http_method; content:"/miner"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"151.240.157.27"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950579/; classtype:trojan-activity;sid:84813679; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950580)"; flow:established,from_client; content:"GET"; http_method; content:"/xmrig"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"151.240.157.27"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950580/; classtype:trojan-activity;sid:84813680; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950581)"; flow:established,from_client; content:"GET"; http_method; content:"/6bqpetbeacon"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"151.240.157.27"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950581/; classtype:trojan-activity;sid:84813681; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950582)"; flow:established,from_client; content:"GET"; http_method; content:"/wallet"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"151.240.157.27"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950582/; classtype:trojan-activity;sid:84813682; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950561)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arc"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"91.92.43.221"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950561/; classtype:trojan-activity;sid:84813661; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950562)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.i686"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"91.92.43.221"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950562/; classtype:trojan-activity;sid:84813662; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950563)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arm6"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"91.92.43.221"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950563/; classtype:trojan-activity;sid:84813663; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950564)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arm7"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"91.92.43.221"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950564/; classtype:trojan-activity;sid:84813664; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950565)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.mpsl"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"91.92.43.221"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950565/; classtype:trojan-activity;sid:84813665; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950566)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.sh4"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"91.92.43.221"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950566/; classtype:trojan-activity;sid:84813666; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950567)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arm5"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"91.92.43.221"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950567/; classtype:trojan-activity;sid:84813667; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950568)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.x86"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"91.92.43.221"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950568/; classtype:trojan-activity;sid:84813668; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950569)"; flow:established,from_client; content:"GET"; http_method; content:"/y7yx0xz1"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"dklak.cam"; http_host; depth:9; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950569/; classtype:trojan-activity;sid:84813669; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950570)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.m68k"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"91.92.43.221"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950570/; classtype:trojan-activity;sid:84813670; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950571)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arm"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"91.92.43.221"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950571/; classtype:trojan-activity;sid:84813671; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950572)"; flow:established,from_client; content:"GET"; http_method; content:"/1.sh"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"91.92.43.221"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950572/; classtype:trojan-activity;sid:84813672; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950573)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.ppc"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"91.92.43.221"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950573/; classtype:trojan-activity;sid:84813673; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950574)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.x86_64"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"91.92.43.221"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950574/; classtype:trojan-activity;sid:84813674; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950575)"; flow:established,from_client; content:"GET"; http_method; content:"/ip2"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"64.235.41.52"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950575/; classtype:trojan-activity;sid:84813675; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950576)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.mips"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"91.92.43.221"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950576/; classtype:trojan-activity;sid:84813676; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950577)"; flow:established,from_client; content:"GET"; http_method; content:"/downloads/tweaks.jar"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"donutsmputilitys.netlify.app"; http_host; depth:28; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950577/; classtype:trojan-activity;sid:84813677; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950559)"; flow:established,from_client; content:"GET"; http_method; content:"/curl/42403afd2906a8f3062e3ddb19b28572d88db9ae74b147319383bd280c6bec0a"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"internetmissouri.com"; http_host; depth:20; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950559/; classtype:trojan-activity;sid:84813659; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950560)"; flow:established,from_client; content:"GET"; http_method; content:"/hunter"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"151.240.157.27"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950560/; classtype:trojan-activity;sid:84813660; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950555)"; flow:established,from_client; content:"GET"; http_method; content:"/ip"; http_uri; depth:3; isdataat:!1,relative; nocase; content:"64.235.41.52"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950555/; classtype:trojan-activity;sid:84813655; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950556)"; flow:established,from_client; content:"GET"; http_method; content:"/30/wemadebestthingsforme.hta|3f|imafeination.pics"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"209.54.102.168"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950556/; classtype:trojan-activity;sid:84813656; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950557)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.sparc"; http_uri; depth:22; isdataat:!1,relative; nocase; content:"91.92.43.221"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950557/; classtype:trojan-activity;sid:84813657; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950558)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.mips64"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"91.92.43.221"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950558/; classtype:trojan-activity;sid:84813658; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950554)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"112.248.245.25"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950554/; classtype:trojan-activity;sid:84813654; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950552)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.134.167.0"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950552/; classtype:trojan-activity;sid:84813652; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950553)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.134.167.0"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950553/; classtype:trojan-activity;sid:84813653; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950551)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.10.70.119"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950551/; classtype:trojan-activity;sid:84813651; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950550)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.44.190.24"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950550/; classtype:trojan-activity;sid:84813650; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950548)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.96.140.65"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950548/; classtype:trojan-activity;sid:84813648; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950549)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"59.96.140.65"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950549/; classtype:trojan-activity;sid:84813649; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950547)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.97.254.36"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950547/; classtype:trojan-activity;sid:84813647; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950545)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.137.37.123"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950545/; classtype:trojan-activity;sid:84813645; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950546)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.141.135.181"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950546/; classtype:trojan-activity;sid:84813646; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950544)"; flow:established,from_client; content:"GET"; http_method; content:"/gdtrupoqncyropd22.exe"; http_uri; depth:22; isdataat:!1,relative; nocase; content:"130.12.182.175"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950544/; classtype:trojan-activity;sid:84813644; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950543)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.228.106.96"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950543/; classtype:trojan-activity;sid:84813643; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950542)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"113.228.106.96"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950542/; classtype:trojan-activity;sid:84813642; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950541)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.97.255.15"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950541/; classtype:trojan-activity;sid:84813641; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950540)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.52.222.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950540/; classtype:trojan-activity;sid:84813640; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950539)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.175.254.97"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950539/; classtype:trojan-activity;sid:84813639; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950538)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"124.6.167.113"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950538/; classtype:trojan-activity;sid:84813638; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950537)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.175.254.97"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950537/; classtype:trojan-activity;sid:84813637; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950536)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.148.142.77"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950536/; classtype:trojan-activity;sid:84813636; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950535)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"124.6.169.54"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950535/; classtype:trojan-activity;sid:84813635; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950534)"; flow:established,from_client; content:"GET"; http_method; content:"/g84kfs5n/uploads/inject-test.exe_melted.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"d-j-d.com"; http_host; depth:9; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950534/; classtype:trojan-activity;sid:84813634; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950532)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"61.52.185.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950532/; classtype:trojan-activity;sid:84813632; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950533)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.137.159.194"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950533/; classtype:trojan-activity;sid:84813633; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950531)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"61.52.222.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950531/; classtype:trojan-activity;sid:84813631; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950530)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"101.59.79.119"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950530/; classtype:trojan-activity;sid:84813630; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950529)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.42.225.92"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950529/; classtype:trojan-activity;sid:84813629; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950528)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.189.172.143"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950528/; classtype:trojan-activity;sid:84813628; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950527)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.12.230.43"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950527/; classtype:trojan-activity;sid:84813627; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950525)"; flow:established,from_client; content:"GET"; http_method; content:"/g84kfs5n/plugins/clip64.dll"; http_uri; depth:28; isdataat:!1,relative; nocase; content:"v-w-v.com"; http_host; depth:9; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950525/; classtype:trojan-activity;sid:84813625; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950526)"; flow:established,from_client; content:"GET"; http_method; content:"/g84kfs5n/plugins/clip.dll"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"d-j-d.com"; http_host; depth:9; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950526/; classtype:trojan-activity;sid:84813626; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950524)"; flow:established,from_client; content:"GET"; http_method; content:"/g84kfs5n/uploads/build_amd.exe_melted.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"v-w-v.com"; http_host; depth:9; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950524/; classtype:trojan-activity;sid:84813624; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950523)"; flow:established,from_client; content:"GET"; http_method; content:"/g84kfs5n/uploads/build_amd.exe_melted.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"c-f-u.com"; http_host; depth:9; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950523/; classtype:trojan-activity;sid:84813623; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950518)"; flow:established,from_client; content:"GET"; http_method; content:"/g84kfs5n/plugins/cred.dll"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"d-j-d.com"; http_host; depth:9; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950518/; classtype:trojan-activity;sid:84813618; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950519)"; flow:established,from_client; content:"GET"; http_method; content:"/g84kfs5n/plugins/cred.dll"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"c-f-u.com"; http_host; depth:9; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950519/; classtype:trojan-activity;sid:84813619; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950520)"; flow:established,from_client; content:"GET"; http_method; content:"/g84kfs5n/plugins/cred.dll"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"v-w-v.com"; http_host; depth:9; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950520/; classtype:trojan-activity;sid:84813620; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950521)"; flow:established,from_client; content:"GET"; http_method; content:"/g84kfs5n/plugins/cred64.dll"; http_uri; depth:28; isdataat:!1,relative; nocase; content:"c-f-u.com"; http_host; depth:9; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950521/; classtype:trojan-activity;sid:84813621; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950522)"; flow:established,from_client; content:"GET"; http_method; content:"/g84kfs5n/plugins/cred64.dll"; http_uri; depth:28; isdataat:!1,relative; nocase; content:"v-w-v.com"; http_host; depth:9; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950522/; classtype:trojan-activity;sid:84813622; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950513)"; flow:established,from_client; content:"GET"; http_method; content:"/g84kfs5n/plugins/clip64.dll"; http_uri; depth:28; isdataat:!1,relative; nocase; content:"c-f-u.com"; http_host; depth:9; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950513/; classtype:trojan-activity;sid:84813613; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950514)"; flow:established,from_client; content:"GET"; http_method; content:"/g84kfs5n/plugins/clip.dll"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"v-w-v.com"; http_host; depth:9; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950514/; classtype:trojan-activity;sid:84813614; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950515)"; flow:established,from_client; content:"GET"; http_method; content:"/g84kfs5n/plugins/cred64.dll"; http_uri; depth:28; isdataat:!1,relative; nocase; content:"d-j-d.com"; http_host; depth:9; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950515/; classtype:trojan-activity;sid:84813615; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950516)"; flow:established,from_client; content:"GET"; http_method; content:"/g84kfs5n/plugins/clip64.dll"; http_uri; depth:28; isdataat:!1,relative; nocase; content:"d-j-d.com"; http_host; depth:9; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950516/; classtype:trojan-activity;sid:84813616; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950517)"; flow:established,from_client; content:"GET"; http_method; content:"/g84kfs5n/plugins/clip.dll"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"c-f-u.com"; http_host; depth:9; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950517/; classtype:trojan-activity;sid:84813617; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950508)"; flow:established,from_client; content:"GET"; http_method; content:"/g84kfs5n/plugins/clip.dll"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"ld-cf.com"; http_host; depth:9; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950508/; classtype:trojan-activity;sid:84813608; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950509)"; flow:established,from_client; content:"GET"; http_method; content:"/g84kfs5n/plugins/clip64.dll"; http_uri; depth:28; isdataat:!1,relative; nocase; content:"ld-cf.com"; http_host; depth:9; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950509/; classtype:trojan-activity;sid:84813609; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950510)"; flow:established,from_client; content:"GET"; http_method; content:"/g84kfs5n/plugins/cred64.dll"; http_uri; depth:28; isdataat:!1,relative; nocase; content:"ld-cf.com"; http_host; depth:9; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950510/; classtype:trojan-activity;sid:84813610; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950511)"; flow:established,from_client; content:"GET"; http_method; content:"/g84kfs5n/plugins/cred.dll"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"ld-cf.com"; http_host; depth:9; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950511/; classtype:trojan-activity;sid:84813611; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950512)"; flow:established,from_client; content:"GET"; http_method; content:"/g84kfs5n/uploads/build_amd.exe_melted.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"ld-cf.com"; http_host; depth:9; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950512/; classtype:trojan-activity;sid:84813612; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950507)"; flow:established,from_client; content:"GET"; http_method; content:"/g84kfs5n/uploads/build_amd.exe_melted.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"109.238.87.75"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950507/; classtype:trojan-activity;sid:84813607; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950506)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.9.68.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950506/; classtype:trojan-activity;sid:84813606; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950505)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.18.99.133"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950505/; classtype:trojan-activity;sid:84813605; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950504)"; flow:established,from_client; content:"GET"; http_method; content:"/g84kfs5n/plugins/cred64.dll"; http_uri; depth:28; isdataat:!1,relative; nocase; content:"109.238.87.75"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950504/; classtype:trojan-activity;sid:84813604; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950502)"; flow:established,from_client; content:"GET"; http_method; content:"/g84kfs5n/plugins/clip.dll"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"109.238.87.75"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950502/; classtype:trojan-activity;sid:84813602; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950503)"; flow:established,from_client; content:"GET"; http_method; content:"/g84kfs5n/plugins/clip64.dll"; http_uri; depth:28; isdataat:!1,relative; nocase; content:"109.238.87.75"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950503/; classtype:trojan-activity;sid:84813603; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950501)"; flow:established,from_client; content:"GET"; http_method; content:"/g84kfs5n/uploads/build_amd.exe_melted.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"d-j-d.com"; http_host; depth:9; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950501/; classtype:trojan-activity;sid:84813601; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950500)"; flow:established,from_client; content:"GET"; http_method; content:"/g84kfs5n/plugins/cred.dll"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"109.238.87.75"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950500/; classtype:trojan-activity;sid:84813600; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950499)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.53.69.165"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950499/; classtype:trojan-activity;sid:84813599; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950498)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.52.22.187"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950498/; classtype:trojan-activity;sid:84813598; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950497)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"39.77.250.226"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950497/; classtype:trojan-activity;sid:84813597; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950495)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.157.39.145"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950495/; classtype:trojan-activity;sid:84813595; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950496)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.49.24.236"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950496/; classtype:trojan-activity;sid:84813596; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950493)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"45.172.218.85"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950493/; classtype:trojan-activity;sid:84813593; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950494)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"45.166.188.48"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950494/; classtype:trojan-activity;sid:84813594; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950492)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.15.10.194"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950492/; classtype:trojan-activity;sid:84813592; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950491)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"113.53.69.165"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950491/; classtype:trojan-activity;sid:84813591; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950490)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.214.231.246"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950490/; classtype:trojan-activity;sid:84813590; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950489)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.53.140.82"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950489/; classtype:trojan-activity;sid:84813589; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950488)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"66.205.236.190"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950488/; classtype:trojan-activity;sid:84813588; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950487)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.52.22.187"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950487/; classtype:trojan-activity;sid:84813587; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950486)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.134.163.77"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950486/; classtype:trojan-activity;sid:84813586; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950484)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.215.124.78"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950484/; classtype:trojan-activity;sid:84813584; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950485)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.216.33.36"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950485/; classtype:trojan-activity;sid:84813585; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950483)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.55.130.202"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950483/; classtype:trojan-activity;sid:84813583; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950482)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.127.64.151"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950482/; classtype:trojan-activity;sid:84813582; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950479)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.52.182.76"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950479/; classtype:trojan-activity;sid:84813579; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950480)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.45.183.118"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950480/; classtype:trojan-activity;sid:84813580; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950481)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.55.130.202"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950481/; classtype:trojan-activity;sid:84813581; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950476)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"61.243.141.19"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950476/; classtype:trojan-activity;sid:84813576; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950477)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"37.34.181.111"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950477/; classtype:trojan-activity;sid:84813577; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950478)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.23.236.153"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950478/; classtype:trojan-activity;sid:84813578; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950474)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.53.84.98"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950474/; classtype:trojan-activity;sid:84813574; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950475)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.52.185.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950475/; classtype:trojan-activity;sid:84813575; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950473)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.117.119.237"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950473/; classtype:trojan-activity;sid:84813573; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950472)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.174.13.217"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950472/; classtype:trojan-activity;sid:84813572; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950468)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.151.87.39"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950468/; classtype:trojan-activity;sid:84813568; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950469)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.165.199.119"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950469/; classtype:trojan-activity;sid:84813569; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950470)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.113.206.163"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950470/; classtype:trojan-activity;sid:84813570; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950471)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.119.11.178"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950471/; classtype:trojan-activity;sid:84813571; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950466)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.180.153.189"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950466/; classtype:trojan-activity;sid:84813566; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950467)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.116.81.29"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950467/; classtype:trojan-activity;sid:84813567; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950465)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.116.120.14"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950465/; classtype:trojan-activity;sid:84813565; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950464)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.m+-o+-"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"112.198.194.175"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950464/; classtype:trojan-activity;sid:84813564; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950462)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"163.142.77.44"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950462/; classtype:trojan-activity;sid:84813562; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950463)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.12.232.231"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950463/; classtype:trojan-activity;sid:84813563; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950461)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"139.227.137.155"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950461/; classtype:trojan-activity;sid:84813561; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950460)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.12.232.231"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950460/; classtype:trojan-activity;sid:84813560; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950459)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"216.126.86.128"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950459/; classtype:trojan-activity;sid:84813559; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950458)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.206.115.18"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950458/; classtype:trojan-activity;sid:84813558; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950457)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"201.110.21.150"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950457/; classtype:trojan-activity;sid:84813557; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950456)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"201.110.21.150"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950456/; classtype:trojan-activity;sid:84813556; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950455)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"221.1.227.111"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950455/; classtype:trojan-activity;sid:84813555; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950453)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.11.8.153"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950453/; classtype:trojan-activity;sid:84813553; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950454)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.84.214.210"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950454/; classtype:trojan-activity;sid:84813554; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950451)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.11.8.153"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950451/; classtype:trojan-activity;sid:84813551; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950452)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"220.198.112.236"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950452/; classtype:trojan-activity;sid:84813552; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950450)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"219.157.20.98"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950450/; classtype:trojan-activity;sid:84813550; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950449)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.19.211.40"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950449/; classtype:trojan-activity;sid:84813549; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950448)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.19.213.66"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950448/; classtype:trojan-activity;sid:84813548; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950447)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"180.191.49.27"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950447/; classtype:trojan-activity;sid:84813547; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950446)"; flow:established,from_client; content:"GET"; http_method; content:"/bins.sh"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"36.255.97.170"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950446/; classtype:trojan-activity;sid:84813546; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950445)"; flow:established,from_client; content:"GET"; http_method; content:"/j2fmm/1.tar.gz"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"up.sb"; http_host; depth:5; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950445/; classtype:trojan-activity;sid:84813545; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950441)"; flow:established,from_client; content:"GET"; http_method; content:"/hunter"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"151.240.157.27"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950441/; classtype:trojan-activity;sid:84813541; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950442)"; flow:established,from_client; content:"GET"; http_method; content:"/xmrig"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"151.240.157.27"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950442/; classtype:trojan-activity;sid:84813542; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950443)"; flow:established,from_client; content:"GET"; http_method; content:"/miner"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"151.240.157.27"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950443/; classtype:trojan-activity;sid:84813543; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950444)"; flow:established,from_client; content:"GET"; http_method; content:"/beacon|3f|id=chain_01d0c0c1a3c5"; http_uri; depth:32; isdataat:!1,relative; nocase; content:"151.240.157.27"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950444/; classtype:trojan-activity;sid:84813544; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950440)"; flow:established,from_client; content:"GET"; http_method; content:"/sysd.bin"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"205.185.117.117"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950440/; classtype:trojan-activity;sid:84813540; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950439)"; flow:established,from_client; content:"GET"; http_method; content:"/g.sh"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"205.185.117.117"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950439/; classtype:trojan-activity;sid:84813539; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950436)"; flow:established,from_client; content:"GET"; http_method; content:"/bins.sh"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950436/; classtype:trojan-activity;sid:84813536; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950437)"; flow:established,from_client; content:"GET"; http_method; content:"/r5g6y6beacon"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"151.240.157.27"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950437/; classtype:trojan-activity;sid:84813537; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950438)"; flow:established,from_client; content:"GET"; http_method; content:"/wallet"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"151.240.157.27"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950438/; classtype:trojan-activity;sid:84813538; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950435)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.6.101.155"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950435/; classtype:trojan-activity;sid:84813535; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950434)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.10.70.119"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950434/; classtype:trojan-activity;sid:84813534; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950433)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"121.202.142.137"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950433/; classtype:trojan-activity;sid:84813533; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950431)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.14.235.37"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950431/; classtype:trojan-activity;sid:84813531; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950432)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.215.140.2"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950432/; classtype:trojan-activity;sid:84813532; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950430)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.179.250.149"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950430/; classtype:trojan-activity;sid:84813530; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950429)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.55.129.26"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950429/; classtype:trojan-activity;sid:84813529; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950426)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.63.245.203"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950426/; classtype:trojan-activity;sid:84813526; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950427)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.4.18.86"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950427/; classtype:trojan-activity;sid:84813527; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950428)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"121.231.77.24"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950428/; classtype:trojan-activity;sid:84813528; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950425)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"119.166.84.226"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950425/; classtype:trojan-activity;sid:84813525; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950424)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.55.206.233"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950424/; classtype:trojan-activity;sid:84813524; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950423)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"45.183.184.74"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950423/; classtype:trojan-activity;sid:84813523; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950422)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.184.177.151"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950422/; classtype:trojan-activity;sid:84813522; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950421)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.55.129.26"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950421/; classtype:trojan-activity;sid:84813521; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950420)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1557740644179517531/1560206841797939210/bundle_3.zip|3f|ex=6ad1df5a|7c|26|7c|is=6ad08dda|7c|26|7c|hm=94d7059bfa407e04fa9e30edd05d792a68272c07e2bd3ab74e919b8647f857ae|7c|26|7c|"; http_uri; depth:188; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950420/; classtype:trojan-activity;sid:84813520; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950419)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"202.83.167.117"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950419/; classtype:trojan-activity;sid:84813519; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950418)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.55.203.30"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950418/; classtype:trojan-activity;sid:84813518; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950416)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.55.238.219"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950416/; classtype:trojan-activity;sid:84813516; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950417)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.55.206.233"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950417/; classtype:trojan-activity;sid:84813517; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950415)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"103.66.176.192"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950415/; classtype:trojan-activity;sid:84813515; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950414)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.96.138.155"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950414/; classtype:trojan-activity;sid:84813514; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950413)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"59.96.138.155"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950413/; classtype:trojan-activity;sid:84813513; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950412)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.227.196.224"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950412/; classtype:trojan-activity;sid:84813512; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950409)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.226.236.209"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950409/; classtype:trojan-activity;sid:84813509; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950410)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.62.152.23"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950410/; classtype:trojan-activity;sid:84813510; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950411)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.62.152.23"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950411/; classtype:trojan-activity;sid:84813511; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950407)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.230.35.117"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950407/; classtype:trojan-activity;sid:84813507; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950408)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.226.236.209"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950408/; classtype:trojan-activity;sid:84813508; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950405)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"103.66.176.192"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950405/; classtype:trojan-activity;sid:84813505; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950406)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.55.61.246"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950406/; classtype:trojan-activity;sid:84813506; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950404)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.186.138.183"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950404/; classtype:trojan-activity;sid:84813504; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950403)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"210.208.106.68"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950403/; classtype:trojan-activity;sid:84813503; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950402)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"105.184.182.218"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950402/; classtype:trojan-activity;sid:84813502; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950401)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.a"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.107.215.35"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950401/; classtype:trojan-activity;sid:84813501; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950400)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.m"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"119.30.117.179"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950400/; classtype:trojan-activity;sid:84813500; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950399)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"95.9.35.137"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950399/; classtype:trojan-activity;sid:84813499; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950397)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.225.199.101"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950397/; classtype:trojan-activity;sid:84813497; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950398)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.50.104.42"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950398/; classtype:trojan-activity;sid:84813498; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950396)"; flow:established,from_client; content:"GET"; http_method; content:"/65fjj9yhlxlgyamdvohlnpzoz6pdqsxzh38llkt6vqol0sihrwoxp0rrbfp5j49nzc3t1ibdjf-k9lsq0p30jcaunclewlwfo63hp_iqvgjwjiixxotz8pv13q9dgvuajcfpjkg88otd8xea9cxgftsotixaf_pld4oygzevriv_yg/f5or9v58g1hmf84/malwarerat.rar"; http_uri; depth:206; isdataat:!1,relative; nocase; content:"download1593.mediafire.com"; http_host; depth:26; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950396/; classtype:trojan-activity;sid:84813496; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950395)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.61.111.244"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950395/; classtype:trojan-activity;sid:84813495; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950394)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.184.125.244"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950394/; classtype:trojan-activity;sid:84813494; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950393)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"216.126.86.64"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950393/; classtype:trojan-activity;sid:84813493; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950392)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.55.61.217"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950392/; classtype:trojan-activity;sid:84813492; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950391)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.55.203.30"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950391/; classtype:trojan-activity;sid:84813491; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950390)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"121.202.142.137"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950390/; classtype:trojan-activity;sid:84813490; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950389)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.190.69.149"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950389/; classtype:trojan-activity;sid:84813489; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950388)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.62.117.230"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950388/; classtype:trojan-activity;sid:84813488; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950387)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"95.9.35.137"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950387/; classtype:trojan-activity;sid:84813487; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950386)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"202.166.165.60"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950386/; classtype:trojan-activity;sid:84813486; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950385)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/mpsl"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"82.22.23.132"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950385/; classtype:trojan-activity;sid:84813485; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950384)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"46.236.65.27"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950384/; classtype:trojan-activity;sid:84813484; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950383)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.85.124.15"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950383/; classtype:trojan-activity;sid:84813483; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950382)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.53.69.133"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950382/; classtype:trojan-activity;sid:84813482; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950381)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.180.134.170"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950381/; classtype:trojan-activity;sid:84813481; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950379)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.90.191.229"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950379/; classtype:trojan-activity;sid:84813479; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950380)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"59.90.191.229"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950380/; classtype:trojan-activity;sid:84813480; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950377)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"221.15.178.114"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950377/; classtype:trojan-activity;sid:84813477; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950378)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.127.186.27"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950378/; classtype:trojan-activity;sid:84813478; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950376)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"113.53.69.133"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950376/; classtype:trojan-activity;sid:84813476; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950375)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.12.226.4"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950375/; classtype:trojan-activity;sid:84813475; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950374)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"203.204.246.77"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950374/; classtype:trojan-activity;sid:84813474; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950373)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.28.194.30"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950373/; classtype:trojan-activity;sid:84813473; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950372)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.129.152.49"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950372/; classtype:trojan-activity;sid:84813472; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950371)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.141.36.15"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950371/; classtype:trojan-activity;sid:84813471; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950370)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.214.231.246"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950370/; classtype:trojan-activity;sid:84813470; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950369)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"116.10.132.105"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950369/; classtype:trojan-activity;sid:84813469; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950368)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"188.225.2.32"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950368/; classtype:trojan-activity;sid:84813468; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950367)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.50.104.42"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950367/; classtype:trojan-activity;sid:84813467; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950366)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"219.157.61.33"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950366/; classtype:trojan-activity;sid:84813466; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950364)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.12.226.4"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950364/; classtype:trojan-activity;sid:84813464; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950365)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.14.176.37"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950365/; classtype:trojan-activity;sid:84813465; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950363)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"116.138.107.83"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950363/; classtype:trojan-activity;sid:84813463; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950362)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"188.225.2.32"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950362/; classtype:trojan-activity;sid:84813462; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950361)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"46.236.65.9"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950361/; classtype:trojan-activity;sid:84813461; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950359)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.41.4.218"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950359/; classtype:trojan-activity;sid:84813459; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950360)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"14.177.78.121"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950360/; classtype:trojan-activity;sid:84813460; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950358)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.184.182.218"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950358/; classtype:trojan-activity;sid:84813458; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950357)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.53.238.49"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950357/; classtype:trojan-activity;sid:84813457; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950356)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.53.0.213"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950356/; classtype:trojan-activity;sid:84813456; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950355)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.166.84.226"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950355/; classtype:trojan-activity;sid:84813455; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950354)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.126.90.240"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950354/; classtype:trojan-activity;sid:84813454; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950353)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"117.223.140.39"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950353/; classtype:trojan-activity;sid:84813453; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950352)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"117.223.140.12"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950352/; classtype:trojan-activity;sid:84813452; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950351)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"117.223.140.12"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950351/; classtype:trojan-activity;sid:84813451; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950350)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"38.46.31.127"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950350/; classtype:trojan-activity;sid:84813450; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950349)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"61.53.238.49"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950349/; classtype:trojan-activity;sid:84813449; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950348)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.215.50.126"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950348/; classtype:trojan-activity;sid:84813448; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950347)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.120.96.206"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950347/; classtype:trojan-activity;sid:84813447; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950343)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.55.53.145"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950343/; classtype:trojan-activity;sid:84813443; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950344)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.55.58.189"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950344/; classtype:trojan-activity;sid:84813444; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950345)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.141.36.15"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950345/; classtype:trojan-activity;sid:84813445; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950346)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.114.32.149"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950346/; classtype:trojan-activity;sid:84813446; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950342)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.165.84.140"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950342/; classtype:trojan-activity;sid:84813442; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950340)"; flow:established,from_client; content:"GET"; http_method; content:"/mips64"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"103.170.217.170"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950340/; classtype:trojan-activity;sid:84813440; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950341)"; flow:established,from_client; content:"GET"; http_method; content:"/mipsle"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"103.170.217.170"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950341/; classtype:trojan-activity;sid:84813441; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950337)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.m"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"58.37.101.152"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950337/; classtype:trojan-activity;sid:84813437; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950338)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.m"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"103.99.196.0"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950338/; classtype:trojan-activity;sid:84813438; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950339)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.m"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"39.34.171.37"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950339/; classtype:trojan-activity;sid:84813439; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950336)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"103.172.186.194"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950336/; classtype:trojan-activity;sid:84813436; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950335)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.m"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.121.148.252"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950335/; classtype:trojan-activity;sid:84813435; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950334)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.exe"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"64.235.41.67"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950334/; classtype:trojan-activity;sid:84813434; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950333)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1543991927924457544/1560030195078004736/bundle_6.zip|3f|ex=6ad13ad6|7c|26|7c|is=6acfe956|7c|26|7c|hm=1c381935c200ef9ef1be05e1725c24f3b1bdfa933a7506d5e1b6f757083c882a|7c|26|7c|"; http_uri; depth:188; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950333/; classtype:trojan-activity;sid:84813433; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950332)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1557944891575762984/1560056425315573770/bundle_3.zip|3f|ex=6ad15344|7c|26|7c|is=6ad001c4|7c|26|7c|hm=74002fd9d022845b0e5d1098907aa6016c8626602788827fee2119bcd63104fe|7c|26|7c|"; http_uri; depth:188; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950332/; classtype:trojan-activity;sid:84813432; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950331)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1519428468599951424/1560042068284284979/bundle.zip|3f|ex=6ad145e5|7c|26|7c|is=6acff465|7c|26|7c|hm=cce26801b9dc586711f9f78e02d3014b2ffc36d8c9cbeca777cbd9ec91ab1ae4|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950331/; classtype:trojan-activity;sid:84813431; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950329)"; flow:established,from_client; content:"GET"; http_method; content:"/mc-mod/dw"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"totemstudios.xyz"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950329/; classtype:trojan-activity;sid:84813429; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950330)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1556411753053683722/1560030733433573437/bundle.zip|3f|ex=6ad13b56|7c|26|7c|is=6acfe9d6|7c|26|7c|hm=d4dc7f01e45495509c3d85b6fb1010b0bcc244b733195270d95b1d3722cfb131|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950330/; classtype:trojan-activity;sid:84813430; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950327)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1556290935443431436/1560008090047225866/bundle.zip|3f|ex=6ad12640|7c|26|7c|is=6acfd4c0|7c|26|7c|hm=5543546bcd7f0a4dc410e82129bd646b2a8af4e0d4c13414cf22ba0a9917eab1|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950327/; classtype:trojan-activity;sid:84813427; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950328)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1559687529396051989/1560085193094733916/bundle.zip|3f|ex=6ad16e0f|7c|26|7c|is=6ad01c8f|7c|26|7c|hm=691b723e4cf3bdf17c0dc60a6dc724529734d5bff8fd737b7d6b336aecdef529|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950328/; classtype:trojan-activity;sid:84813428; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950322)"; flow:established,from_client; content:"GET"; http_method; content:"/d/qwyvs376"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"csgroup.host"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950322/; classtype:trojan-activity;sid:84813422; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950323)"; flow:established,from_client; content:"GET"; http_method; content:"/d/drkjmzrn"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"csgroup.host"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950323/; classtype:trojan-activity;sid:84813423; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950324)"; flow:established,from_client; content:"GET"; http_method; content:"/f/qwyvs376"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"csgroup.host"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950324/; classtype:trojan-activity;sid:84813424; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950325)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.a"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.127.170.84"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950325/; classtype:trojan-activity;sid:84813425; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950326)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1552663510213861469/1560028889374396476/bundle_2.zip|3f|ex=6ad1399f|7c|26|7c|is=6acfe81f|7c|26|7c|hm=992f9e873193843fa8656ba1f0ae7857ad079473b2420ee9d6df8fa4398f2a82|7c|26|7c|"; http_uri; depth:188; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950326/; classtype:trojan-activity;sid:84813426; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950321)"; flow:established,from_client; content:"GET"; http_method; content:"/f/drkjmzrn"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"csgroup.host"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950321/; classtype:trojan-activity;sid:84813421; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950317)"; flow:established,from_client; content:"GET"; http_method; content:"/blankgrabberrt/blank-grabber/raw/refs/heads/main/blank-grabber-main/builder.exe"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950317/; classtype:trojan-activity;sid:84813417; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950318)"; flow:established,from_client; content:"GET"; http_method; content:"/blankgrabberrt/blankgrabberv3.04/raw/refs/heads/main/build%20grabber.exe"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950318/; classtype:trojan-activity;sid:84813418; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950319)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"196.210.57.231"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950319/; classtype:trojan-activity;sid:84813419; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950320)"; flow:established,from_client; content:"GET"; http_method; content:"/blankgrabberrt/synapsex-cracked-by-xexify/raw/refs/heads/main/synapse_x_cracked.exe"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950320/; classtype:trojan-activity;sid:84813420; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950316)"; flow:established,from_client; content:"GET"; http_method; content:"/i.exe"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"64.235.41.67"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950316/; classtype:trojan-activity;sid:84813416; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950315)"; flow:established,from_client; content:"GET"; http_method; content:"/9ejbtod7vpfglemouzzujixckoog4jixznq9hah2he6fxn3v4j65sq1gsyd_v4gmm-4aswxtkxjlg8t1ksmr82-lkwqvycwso4ptdz1d5vanrcevxmqugwd-pqph83s6tuaz3gqtt0jegigr0vog6zvcqkcpqcx-wp3a5tiu3owwczqv/7qqt260e0r7iiel/silver+bullet+pro+v1.0.0+by+blackwolf.rar"; http_uri; depth:235; isdataat:!1,relative; nocase; content:"download2287.mediafire.com"; http_host; depth:26; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950315/; classtype:trojan-activity;sid:84813415; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950305)"; flow:established,from_client; content:"GET"; http_method; content:"/f/6fneq9d6"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"csgroup.host"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950305/; classtype:trojan-activity;sid:84813405; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950306)"; flow:established,from_client; content:"GET"; http_method; content:"/api/public/download/radium.jar"; http_uri; depth:31; isdataat:!1,relative; nocase; content:"donutsmpclientts.lovable.app"; http_host; depth:28; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950306/; classtype:trojan-activity;sid:84813406; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950307)"; flow:established,from_client; content:"GET"; http_method; content:"/api/public/download/krypton.jar"; http_uri; depth:32; isdataat:!1,relative; nocase; content:"donutsmpclientts.lovable.app"; http_host; depth:28; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950307/; classtype:trojan-activity;sid:84813407; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950308)"; flow:established,from_client; content:"GET"; http_method; content:"/api/public/download/corz.jar"; http_uri; depth:29; isdataat:!1,relative; nocase; content:"donutsmpclientts.lovable.app"; http_host; depth:28; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950308/; classtype:trojan-activity;sid:84813408; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950309)"; flow:established,from_client; content:"GET"; http_method; content:"/api/public/download/gooba.jar"; http_uri; depth:30; isdataat:!1,relative; nocase; content:"donutsmpclientts.lovable.app"; http_host; depth:28; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950309/; classtype:trojan-activity;sid:84813409; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950310)"; flow:established,from_client; content:"GET"; http_method; content:"/api/public/download/dqrkis.jar"; http_uri; depth:31; isdataat:!1,relative; nocase; content:"donutsmpclientts.lovable.app"; http_host; depth:28; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950310/; classtype:trojan-activity;sid:84813410; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950311)"; flow:established,from_client; content:"GET"; http_method; content:"/api/public/download/zyron.jar"; http_uri; depth:30; isdataat:!1,relative; nocase; content:"donutsmpclientts.lovable.app"; http_host; depth:28; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950311/; classtype:trojan-activity;sid:84813411; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950312)"; flow:established,from_client; content:"GET"; http_method; content:"/api/public/download/fakepay.jar"; http_uri; depth:32; isdataat:!1,relative; nocase; content:"donutsmpclientts.lovable.app"; http_host; depth:28; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950312/; classtype:trojan-activity;sid:84813412; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950313)"; flow:established,from_client; content:"GET"; http_method; content:"/api/public/download/frost.jar"; http_uri; depth:30; isdataat:!1,relative; nocase; content:"donutsmpclientts.lovable.app"; http_host; depth:28; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950313/; classtype:trojan-activity;sid:84813413; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950314)"; flow:established,from_client; content:"GET"; http_method; content:"/api/public/download/xenon.jar"; http_uri; depth:30; isdataat:!1,relative; nocase; content:"donutsmpclientts.lovable.app"; http_host; depth:28; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950314/; classtype:trojan-activity;sid:84813414; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950296)"; flow:established,from_client; content:"GET"; http_method; content:"/dvnx.zip"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"new.omsules.life"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950296/; classtype:trojan-activity;sid:84813396; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950297)"; flow:established,from_client; content:"GET"; http_method; content:"/f/zvuyhx8h"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"csgroup.host"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950297/; classtype:trojan-activity;sid:84813397; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950298)"; flow:established,from_client; content:"GET"; http_method; content:"/d/vqbdtaek"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"csgroup.host"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950298/; classtype:trojan-activity;sid:84813398; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950299)"; flow:established,from_client; content:"GET"; http_method; content:"/d/zvuyhx8h"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"csgroup.host"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950299/; classtype:trojan-activity;sid:84813399; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950300)"; flow:established,from_client; content:"GET"; http_method; content:"/944"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"167.148.201.191"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950300/; classtype:trojan-activity;sid:84813400; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950301)"; flow:established,from_client; content:"GET"; http_method; content:"/f/vqbdtaek"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"csgroup.host"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950301/; classtype:trojan-activity;sid:84813401; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950302)"; flow:established,from_client; content:"GET"; http_method; content:"/configx.txt"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"tangible-drink.surge.sh"; http_host; depth:23; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950302/; classtype:trojan-activity;sid:84813402; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950303)"; flow:established,from_client; content:"GET"; http_method; content:"/d/6fneq9d6"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"csgroup.host"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950303/; classtype:trojan-activity;sid:84813403; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950304)"; flow:established,from_client; content:"GET"; http_method; content:"/curl/6bab7f3072580dd7a8fc3bf0ca52c98d3136ed0839e61c7e7794494b3b8c03ac"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"therapygeorgia.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950304/; classtype:trojan-activity;sid:84813404; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950295)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"112.198.195.68"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950295/; classtype:trojan-activity;sid:84813395; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950294)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.180.142.10"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950294/; classtype:trojan-activity;sid:84813394; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950293)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"188.129.251.7"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950293/; classtype:trojan-activity;sid:84813393; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950292)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"196.190.69.149"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950292/; classtype:trojan-activity;sid:84813392; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950291)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.147.204.98"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950291/; classtype:trojan-activity;sid:84813391; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950290)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.215.50.126"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950290/; classtype:trojan-activity;sid:84813390; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950289)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.127.68.131"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950289/; classtype:trojan-activity;sid:84813389; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950288)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.184.224.107"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950288/; classtype:trojan-activity;sid:84813388; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950287)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.225.242.219"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950287/; classtype:trojan-activity;sid:84813387; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950286)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.225.199.101"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950286/; classtype:trojan-activity;sid:84813386; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950283)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"61.54.43.105"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950283/; classtype:trojan-activity;sid:84813383; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950284)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.126.87.235"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950284/; classtype:trojan-activity;sid:84813384; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950285)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.126.87.235"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950285/; classtype:trojan-activity;sid:84813385; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950282)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.113.43.146"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950282/; classtype:trojan-activity;sid:84813382; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950281)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.157.177.213"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950281/; classtype:trojan-activity;sid:84813381; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950280)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"103.140.87.105"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_15; reference:url, urlhaus.abuse.ch/url/3950280/; classtype:trojan-activity;sid:84813380; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950279)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.127.68.131"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950279/; classtype:trojan-activity;sid:84813379; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950278)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.227.131.223"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950278/; classtype:trojan-activity;sid:84813378; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950275)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.228.247.58"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950275/; classtype:trojan-activity;sid:84813375; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950276)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.229.216.163"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950276/; classtype:trojan-activity;sid:84813376; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950277)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.227.131.223"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950277/; classtype:trojan-activity;sid:84813377; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950274)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.189.98.110"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950274/; classtype:trojan-activity;sid:84813374; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950273)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"219.157.177.213"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950273/; classtype:trojan-activity;sid:84813373; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950272)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"119.179.215.124"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950272/; classtype:trojan-activity;sid:84813372; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950271)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.234.118.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950271/; classtype:trojan-activity;sid:84813371; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950270)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"83.233.56.26"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950270/; classtype:trojan-activity;sid:84813370; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950269)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.25.107.235"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950269/; classtype:trojan-activity;sid:84813369; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950268)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"46.252.33.253"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950268/; classtype:trojan-activity;sid:84813368; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950267)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"95.237.154.159"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950267/; classtype:trojan-activity;sid:84813367; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950266)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"113.238.161.206"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950266/; classtype:trojan-activity;sid:84813366; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950265)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.121.154.159"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950265/; classtype:trojan-activity;sid:84813365; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950264)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.15.75.224"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950264/; classtype:trojan-activity;sid:84813364; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950260)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.138.213.220"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950260/; classtype:trojan-activity;sid:84813360; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950261)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.227.105.162"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950261/; classtype:trojan-activity;sid:84813361; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950262)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.141.101.135"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950262/; classtype:trojan-activity;sid:84813362; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950263)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.138.213.220"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950263/; classtype:trojan-activity;sid:84813363; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950259)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"218.60.183.2"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950259/; classtype:trojan-activity;sid:84813359; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950258)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"119.180.14.117"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950258/; classtype:trojan-activity;sid:84813358; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950256)"; flow:established,from_client; content:"GET"; http_method; content:"/010100110101010/fghe3tj.x86"; http_uri; depth:28; isdataat:!1,relative; nocase; content:"2.56.175.143"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950256/; classtype:trojan-activity;sid:84813356; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950257)"; flow:established,from_client; content:"GET"; http_method; content:"/fghe3tj.mpsl"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"2.56.175.143"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950257/; classtype:trojan-activity;sid:84813357; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950255)"; flow:established,from_client; content:"GET"; http_method; content:"/010100110101010/fghe3tj.arm7"; http_uri; depth:29; isdataat:!1,relative; nocase; content:"2.56.175.143"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950255/; classtype:trojan-activity;sid:84813355; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950253)"; flow:established,from_client; content:"GET"; http_method; content:"/telnetd"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"45.61.164.81"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950253/; classtype:trojan-activity;sid:84813353; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950254)"; flow:established,from_client; content:"GET"; http_method; content:"/pftp"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"45.61.164.81"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950254/; classtype:trojan-activity;sid:84813354; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950242)"; flow:established,from_client; content:"GET"; http_method; content:"/010100110101010/fghe3tj.arm6"; http_uri; depth:29; isdataat:!1,relative; nocase; content:"2.56.175.143"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950242/; classtype:trojan-activity;sid:84813342; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950243)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/arm5"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"82.22.23.132"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950243/; classtype:trojan-activity;sid:84813343; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950244)"; flow:established,from_client; content:"GET"; http_method; content:"/dwrioej/neon.mips"; http_uri; depth:18; isdataat:!1,relative; nocase; content:"2.56.175.143"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950244/; classtype:trojan-activity;sid:84813344; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950245)"; flow:established,from_client; content:"GET"; http_method; content:"/fghe3tj.ppc"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"2.56.175.143"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950245/; classtype:trojan-activity;sid:84813345; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950246)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/i686"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"82.22.23.132"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950246/; classtype:trojan-activity;sid:84813346; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950247)"; flow:established,from_client; content:"GET"; http_method; content:"/010100110101010/fghe3tj.sh4"; http_uri; depth:28; isdataat:!1,relative; nocase; content:"2.56.175.143"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950247/; classtype:trojan-activity;sid:84813347; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950248)"; flow:established,from_client; content:"GET"; http_method; content:"/wget"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"45.61.164.81"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950248/; classtype:trojan-activity;sid:84813348; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950249)"; flow:established,from_client; content:"GET"; http_method; content:"/ftp"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"45.61.164.81"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950249/; classtype:trojan-activity;sid:84813349; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950250)"; flow:established,from_client; content:"GET"; http_method; content:"/ntpd"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"45.61.164.81"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950250/; classtype:trojan-activity;sid:84813350; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950251)"; flow:established,from_client; content:"GET"; http_method; content:"/cron"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"45.61.164.81"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950251/; classtype:trojan-activity;sid:84813351; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950252)"; flow:established,from_client; content:"GET"; http_method; content:"/apache2"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"45.61.164.81"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950252/; classtype:trojan-activity;sid:84813352; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950236)"; flow:established,from_client; content:"GET"; http_method; content:"/openssh"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"45.61.164.81"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950236/; classtype:trojan-activity;sid:84813336; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950237)"; flow:established,from_client; content:"GET"; http_method; content:"/010100110101010/fghe3tj.mips"; http_uri; depth:29; isdataat:!1,relative; nocase; content:"2.56.175.143"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950237/; classtype:trojan-activity;sid:84813337; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950238)"; flow:established,from_client; content:"GET"; http_method; content:"/010100110101010/fghe3tj.arm"; http_uri; depth:28; isdataat:!1,relative; nocase; content:"2.56.175.143"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950238/; classtype:trojan-activity;sid:84813338; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950239)"; flow:established,from_client; content:"GET"; http_method; content:"/bash"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"45.61.164.81"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950239/; classtype:trojan-activity;sid:84813339; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950240)"; flow:established,from_client; content:"GET"; http_method; content:"/tftp"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"45.61.164.81"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950240/; classtype:trojan-activity;sid:84813340; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950241)"; flow:established,from_client; content:"GET"; http_method; content:"/fghe3tj.mips"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"2.56.175.143"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950241/; classtype:trojan-activity;sid:84813341; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950235)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.133.217.85"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950235/; classtype:trojan-activity;sid:84813335; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950234)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"112.93.137.160"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950234/; classtype:trojan-activity;sid:84813334; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950233)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.14.39.83"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950233/; classtype:trojan-activity;sid:84813333; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950232)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.11.10.206"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950232/; classtype:trojan-activity;sid:84813332; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950231)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"218.60.183.2"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950231/; classtype:trojan-activity;sid:84813331; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950230)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.14.91.223"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950230/; classtype:trojan-activity;sid:84813330; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950229)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.54.43.105"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950229/; classtype:trojan-activity;sid:84813329; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950228)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.165.84.140"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950228/; classtype:trojan-activity;sid:84813328; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950227)"; flow:established,from_client; content:"GET"; http_method; content:"/files/7299809293/dfxhgmx.exe"; http_uri; depth:29; isdataat:!1,relative; nocase; content:"62.60.226.140"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950227/; classtype:trojan-activity;sid:84813327; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950226)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.15.88.109"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950226/; classtype:trojan-activity;sid:84813326; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950225)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.14.176.37"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950225/; classtype:trojan-activity;sid:84813325; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950223)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"46.236.65.27"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950223/; classtype:trojan-activity;sid:84813323; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950224)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.11.10.206"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950224/; classtype:trojan-activity;sid:84813324; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950222)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.116.38.46"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950222/; classtype:trojan-activity;sid:84813322; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950221)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.15.75.224"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950221/; classtype:trojan-activity;sid:84813321; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950220)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.157.61.33"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950220/; classtype:trojan-activity;sid:84813320; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950219)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.137.37.123"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950219/; classtype:trojan-activity;sid:84813319; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950218)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.4.197.98"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950218/; classtype:trojan-activity;sid:84813318; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950217)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.4.197.98"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950217/; classtype:trojan-activity;sid:84813317; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950216)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"120.84.212.113"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950216/; classtype:trojan-activity;sid:84813316; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950215)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.220.145.47"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950215/; classtype:trojan-activity;sid:84813315; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950214)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.184.247.90"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950214/; classtype:trojan-activity;sid:84813314; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950213)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.155.208.94"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950213/; classtype:trojan-activity;sid:84813313; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950212)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"219.157.18.209"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950212/; classtype:trojan-activity;sid:84813312; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950211)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.23.232.97"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950211/; classtype:trojan-activity;sid:84813311; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950210)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.113.207.181"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950210/; classtype:trojan-activity;sid:84813310; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950209)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.243.141.19"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950209/; classtype:trojan-activity;sid:84813309; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950208)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.23.239.98"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950208/; classtype:trojan-activity;sid:84813308; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950207)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.23.232.97"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950207/; classtype:trojan-activity;sid:84813307; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950206)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.210.57.231"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950206/; classtype:trojan-activity;sid:84813306; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950205)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.53.86.56"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950205/; classtype:trojan-activity;sid:84813305; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950204)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.61.9.19"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950204/; classtype:trojan-activity;sid:84813304; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950202)"; flow:established,from_client; content:"GET"; http_method; content:"/arm"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950202/; classtype:trojan-activity;sid:84813302; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950203)"; flow:established,from_client; content:"GET"; http_method; content:"/android_arm"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950203/; classtype:trojan-activity;sid:84813303; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950201)"; flow:established,from_client; content:"GET"; http_method; content:"/i386"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950201/; classtype:trojan-activity;sid:84813301; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950198)"; flow:established,from_client; content:"GET"; http_method; content:"/bot.exe"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950198/; classtype:trojan-activity;sid:84813298; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950199)"; flow:established,from_client; content:"GET"; http_method; content:"/x86"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950199/; classtype:trojan-activity;sid:84813299; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950200)"; flow:established,from_client; content:"GET"; http_method; content:"/arm6"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950200/; classtype:trojan-activity;sid:84813300; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950196)"; flow:established,from_client; content:"GET"; http_method; content:"/arm64"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950196/; classtype:trojan-activity;sid:84813296; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950197)"; flow:established,from_client; content:"GET"; http_method; content:"/android_arm64"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950197/; classtype:trojan-activity;sid:84813297; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950195)"; flow:established,from_client; content:"GET"; http_method; content:"/armv7l"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950195/; classtype:trojan-activity;sid:84813295; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950191)"; flow:established,from_client; content:"GET"; http_method; content:"/amd64"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950191/; classtype:trojan-activity;sid:84813291; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950192)"; flow:established,from_client; content:"GET"; http_method; content:"/mipsle"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950192/; classtype:trojan-activity;sid:84813292; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950193)"; flow:established,from_client; content:"GET"; http_method; content:"/arm5"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950193/; classtype:trojan-activity;sid:84813293; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950194)"; flow:established,from_client; content:"GET"; http_method; content:"/mips"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950194/; classtype:trojan-activity;sid:84813294; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950189)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.15.174.1"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950189/; classtype:trojan-activity;sid:84813289; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950190)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.133.217.85"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950190/; classtype:trojan-activity;sid:84813290; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950188)"; flow:established,from_client; content:"GET"; http_method; content:"/bins.sh"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"5.83.136.39"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950188/; classtype:trojan-activity;sid:84813288; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950187)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.180.147.206"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950187/; classtype:trojan-activity;sid:84813287; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950186)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.5.132.134"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950186/; classtype:trojan-activity;sid:84813286; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950185)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.m"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"88.235.97.150"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950185/; classtype:trojan-activity;sid:84813285; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950184)"; flow:established,from_client; content:"GET"; http_method; content:"/dl.sh"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"oper.atlas101.us.kg"; http_host; depth:19; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950184/; classtype:trojan-activity;sid:84813284; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950183)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.61.9.19"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950183/; classtype:trojan-activity;sid:84813283; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950182)"; flow:established,from_client; content:"GET"; http_method; content:"/88vifno3wcxgekd8gle1ll0meu2yn7aegf33klq5lixlytdyxohfudwr6yvsaahnolgoisctqtv5uvcyfw2e5ggctpxnuha0z9ryts3i05k8hduqwj3ndg2bsj5emn_teeunchj__swpmhzwxnouu0qcswa8rhgpfcfmsv0pcue/q5yumpkgi1cyncb/modded-games.7z"; http_uri; depth:204; isdataat:!1,relative; nocase; content:"download1350.mediafire.com"; http_host; depth:26; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950182/; classtype:trojan-activity;sid:84813282; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950181)"; flow:established,from_client; content:"GET"; http_method; content:"/8yy4pribgk9g15pcchempyg5trifv3dzv8vfocf7-fjnjghv91kp738brfproppy1s_-qgyw8zub-iuqvgvwnuvw-jfy7cfhdq7fcrd1aty7cpdbwutcw_pmaahvk9u9hvths2dvsceyja8pz2qoaec_6zc0kesbztfp9occzzc/175gactmti3k2a7/cs2-client-v1.3.rar"; http_uri; depth:208; isdataat:!1,relative; nocase; content:"download2274.mediafire.com"; http_host; depth:26; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950181/; classtype:trojan-activity;sid:84813281; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950180)"; flow:established,from_client; content:"GET"; http_method; content:"/juekf51m92ng7elvzyscjbpvma-g_a2jj14bocz-dtg68v8zta5ud1y6z5xn7wihwk8atyv9lkmj8xstjw2srkg06meukncfw1kbzmerjujiwdygfzfs9jtorwir22a2hplyizeei1np5i3lri2dr41cexj-es_pgemcofpad7s/l7ztshhv95yv06l/lunarv2.zip"; http_uri; depth:200; isdataat:!1,relative; nocase; content:"download2280.mediafire.com"; http_host; depth:26; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950180/; classtype:trojan-activity;sid:84813280; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950179)"; flow:established,from_client; content:"GET"; http_method; content:"/file_premium/qnngzdupk09hymq/astarterepcx.rar/file"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"www.mediafire.com"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950179/; classtype:trojan-activity;sid:84813279; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950178)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.184.195.150"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950178/; classtype:trojan-activity;sid:84813278; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950177)"; flow:established,from_client; content:"GET"; http_method; content:"/dvnx.zip"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"javb.omsules.life"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950177/; classtype:trojan-activity;sid:84813277; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950176)"; flow:established,from_client; content:"GET"; http_method; content:"/cd/0/get/dj8ioc0vv_a51ykkhi6yleemqmh7a3ss5_c4s8tjmyguuhx1dxmwltxcuilv-hwu1vrjtl7uvzdckdqfvymy007zmacqtxgydjsrevpfcxkpbt90ugtwuchnp4sp-1jft1e1rdl1ga8np46ckrfqvjtw/file|3f|dl=1"; http_uri; depth:175; isdataat:!1,relative; nocase; content:"uc1fb1e965c6d803f97040b2d495.dl.dropboxusercontent.com"; http_host; depth:54; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950176/; classtype:trojan-activity;sid:84813276; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950175)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"170.84.134.172"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950175/; classtype:trojan-activity;sid:84813275; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950174)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.180.33.60"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950174/; classtype:trojan-activity;sid:84813274; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950173)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.184.195.150"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950173/; classtype:trojan-activity;sid:84813273; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950172)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.47.205.188"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950172/; classtype:trojan-activity;sid:84813272; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950171)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.41.8.69"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950171/; classtype:trojan-activity;sid:84813271; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950170)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.207.91.154"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950170/; classtype:trojan-activity;sid:84813270; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950169)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.49.106.15"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950169/; classtype:trojan-activity;sid:84813269; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950168)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.124.19.237"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950168/; classtype:trojan-activity;sid:84813268; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950167)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.224.34.253"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950167/; classtype:trojan-activity;sid:84813267; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950166)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.41.4.218"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950166/; classtype:trojan-activity;sid:84813266; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950165)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.224.147.47"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950165/; classtype:trojan-activity;sid:84813265; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950164)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.180.33.60"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950164/; classtype:trojan-activity;sid:84813264; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950163)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.49.106.15"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950163/; classtype:trojan-activity;sid:84813263; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950162)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.121.148.252"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950162/; classtype:trojan-activity;sid:84813262; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950161)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.241.235.143"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950161/; classtype:trojan-activity;sid:84813261; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950159)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"105.224.34.253"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950159/; classtype:trojan-activity;sid:84813259; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950160)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.41.8.69"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950160/; classtype:trojan-activity;sid:84813260; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950157)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.224.217.178"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950157/; classtype:trojan-activity;sid:84813257; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950158)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.224.174.209"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950158/; classtype:trojan-activity;sid:84813258; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950156)"; flow:established,from_client; content:"GET"; http_method; content:"/dvnx.zip"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"java.omsules.life"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950156/; classtype:trojan-activity;sid:84813256; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950155)"; flow:established,from_client; content:"GET"; http_method; content:"/x/x.exe"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"202.71.14.31"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950155/; classtype:trojan-activity;sid:84813255; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950154)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.238.248.174"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950154/; classtype:trojan-activity;sid:84813254; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950153)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.148.155.205"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950153/; classtype:trojan-activity;sid:84813253; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950152)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.207.91.154"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950152/; classtype:trojan-activity;sid:84813252; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950151)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.56.154.91"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950151/; classtype:trojan-activity;sid:84813251; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950150)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.52.30.36"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950150/; classtype:trojan-activity;sid:84813250; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950149)"; flow:established,from_client; content:"GET"; http_method; content:"/assets/gooba-client-1.21.11.jar"; http_uri; depth:32; isdataat:!1,relative; nocase; content:"clientsorgnet.netlify.app"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950149/; classtype:trojan-activity;sid:84813249; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950148)"; flow:established,from_client; content:"GET"; http_method; content:"/spaceware.zip"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"spaceware.cc"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950148/; classtype:trojan-activity;sid:84813248; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950147)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1533604985240162314/1559952255380230165/bundle.zip|3f|ex=6ad0f240|7c|26|7c|is=6acfa0c0|7c|26|7c|hm=fa472db7594eb563aecfa05c3542013bba0c78a157098c684e7f56d71a61e1c0|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950147/; classtype:trojan-activity;sid:84813247; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950145)"; flow:established,from_client; content:"GET"; http_method; content:"/assets/kr-client-1.21.11.jar"; http_uri; depth:29; isdataat:!1,relative; nocase; content:"clientsorgnet.netlify.app"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950145/; classtype:trojan-activity;sid:84813245; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950146)"; flow:established,from_client; content:"GET"; http_method; content:"/dvnx.zip"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"cde.omsules.life"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950146/; classtype:trojan-activity;sid:84813246; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950143)"; flow:established,from_client; content:"GET"; http_method; content:"/assets/anubis-client-1.21.11.jar"; http_uri; depth:33; isdataat:!1,relative; nocase; content:"clientsorgnet.netlify.app"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950143/; classtype:trojan-activity;sid:84813243; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950144)"; flow:established,from_client; content:"GET"; http_method; content:"/assets/voids-fake-bal.jar"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"clientsorgnet.netlify.app"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950144/; classtype:trojan-activity;sid:84813244; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950140)"; flow:established,from_client; content:"GET"; http_method; content:"/bin/screenconnect.clientsetup.exe|3f|e=access|7c|26|7c|y=guest|7c|26|7c|t=tunde"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"mfschools.screenconnect.com"; http_host; depth:27; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950140/; classtype:trojan-activity;sid:84813240; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950138)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"180.149.219.213"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950138/; classtype:trojan-activity;sid:84813238; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950139)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.227.207.135"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950139/; classtype:trojan-activity;sid:84813239; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950137)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.114.194.42"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950137/; classtype:trojan-activity;sid:84813237; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950136)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.148.147.248"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950136/; classtype:trojan-activity;sid:84813236; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950135)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"180.149.219.213"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950135/; classtype:trojan-activity;sid:84813235; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950134)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.149.80.109"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950134/; classtype:trojan-activity;sid:84813234; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950133)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/x86_64"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"82.22.23.132"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950133/; classtype:trojan-activity;sid:84813233; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950127)"; flow:established,from_client; content:"GET"; http_method; content:"/main_mpsl"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"38.43.93.61"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950127/; classtype:trojan-activity;sid:84813227; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950128)"; flow:established,from_client; content:"GET"; http_method; content:"/main_mips"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"38.43.93.61"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950128/; classtype:trojan-activity;sid:84813228; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950129)"; flow:established,from_client; content:"GET"; http_method; content:"/main_sh4"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"38.43.93.61"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950129/; classtype:trojan-activity;sid:84813229; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950130)"; flow:established,from_client; content:"GET"; http_method; content:"/main_arm"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"38.43.93.61"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950130/; classtype:trojan-activity;sid:84813230; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950131)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/spc"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"82.22.23.132"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950131/; classtype:trojan-activity;sid:84813231; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950132)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/arm"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"82.22.23.132"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950132/; classtype:trojan-activity;sid:84813232; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950118)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/x86"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"82.22.23.132"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950118/; classtype:trojan-activity;sid:84813218; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950119)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/ppc"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"82.22.23.132"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950119/; classtype:trojan-activity;sid:84813219; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950120)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/m68k"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"82.22.23.132"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950120/; classtype:trojan-activity;sid:84813220; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950121)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/mips"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"82.22.23.132"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950121/; classtype:trojan-activity;sid:84813221; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950122)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sh4"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"82.22.23.132"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950122/; classtype:trojan-activity;sid:84813222; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950123)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/arm6"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"82.22.23.132"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950123/; classtype:trojan-activity;sid:84813223; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950124)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/arm7"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"82.22.23.132"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950124/; classtype:trojan-activity;sid:84813224; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950125)"; flow:established,from_client; content:"GET"; http_method; content:"/main_arm7"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"153.56.180.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950125/; classtype:trojan-activity;sid:84813225; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950126)"; flow:established,from_client; content:"GET"; http_method; content:"/main_x86"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"38.43.93.61"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950126/; classtype:trojan-activity;sid:84813226; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950117)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.225.151.155"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950117/; classtype:trojan-activity;sid:84813217; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950116)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.43.100.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950116/; classtype:trojan-activity;sid:84813216; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950115)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.4.97.14"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950115/; classtype:trojan-activity;sid:84813215; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950114)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.44.144.146"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950114/; classtype:trojan-activity;sid:84813214; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950111)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.23.235.232"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950111/; classtype:trojan-activity;sid:84813211; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950112)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.53.116.96"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950112/; classtype:trojan-activity;sid:84813212; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950113)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.44.146.181"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950113/; classtype:trojan-activity;sid:84813213; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950110)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.51.153.198"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950110/; classtype:trojan-activity;sid:84813210; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950109)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"105.225.151.155"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950109/; classtype:trojan-activity;sid:84813209; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950105)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"61.54.43.231"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950105/; classtype:trojan-activity;sid:84813205; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950106)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"61.52.110.184"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950106/; classtype:trojan-activity;sid:84813206; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950107)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.23.235.232"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950107/; classtype:trojan-activity;sid:84813207; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950108)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.137.135.106"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950108/; classtype:trojan-activity;sid:84813208; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950104)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.48.119.213"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950104/; classtype:trojan-activity;sid:84813204; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950103)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.124.19.237"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950103/; classtype:trojan-activity;sid:84813203; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950102)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"196.191.233.24"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950102/; classtype:trojan-activity;sid:84813202; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950101)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.a"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"212.54.86.171"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950101/; classtype:trojan-activity;sid:84813201; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950099)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.18.111.216"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950099/; classtype:trojan-activity;sid:84813199; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950100)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.12.225.135"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950100/; classtype:trojan-activity;sid:84813200; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950098)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"36.32.176.115"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950098/; classtype:trojan-activity;sid:84813198; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950096)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"105.186.99.181"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950096/; classtype:trojan-activity;sid:84813196; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950097)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"36.251.156.38"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950097/; classtype:trojan-activity;sid:84813197; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950095)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.239.221.244"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950095/; classtype:trojan-activity;sid:84813195; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950094)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.5.132.134"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950094/; classtype:trojan-activity;sid:84813194; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950093)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.140.181.122"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950093/; classtype:trojan-activity;sid:84813193; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950092)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.146.1.197"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950092/; classtype:trojan-activity;sid:84813192; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950091)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.225.189.31"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950091/; classtype:trojan-activity;sid:84813191; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950090)"; flow:established,from_client; content:"GET"; http_method; content:"/abuse-antirobot/pentagon"; http_uri; depth:25; isdataat:!1,relative; nocase; content:"45.198.224.60"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950090/; classtype:trojan-activity;sid:84813190; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950089)"; flow:established,from_client; content:"GET"; http_method; content:"/nebulac2-main.zip"; http_uri; depth:18; isdataat:!1,relative; nocase; content:"151.242.30.142"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950089/; classtype:trojan-activity;sid:84813189; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950088)"; flow:established,from_client; content:"GET"; http_method; content:"/bbotnet.zip"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"151.242.30.142"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950088/; classtype:trojan-activity;sid:84813188; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950087)"; flow:established,from_client; content:"GET"; http_method; content:"/darkstresser.tk.zip"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"151.242.30.142"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950087/; classtype:trojan-activity;sid:84813187; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950086)"; flow:established,from_client; content:"GET"; http_method; content:"/bot%20ddos%203.zip"; http_uri; depth:19; isdataat:!1,relative; nocase; content:"151.242.30.142"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950086/; classtype:trojan-activity;sid:84813186; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950083)"; flow:established,from_client; content:"GET"; http_method; content:"/xmrig-arm64"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"207.244.234.243"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950083/; classtype:trojan-activity;sid:84813183; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950084)"; flow:established,from_client; content:"GET"; http_method; content:"/quick-booter.xyz.zip"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"151.242.30.142"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950084/; classtype:trojan-activity;sid:84813184; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950085)"; flow:established,from_client; content:"GET"; http_method; content:"/fathir--c2.zip"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"151.242.30.142"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950085/; classtype:trojan-activity;sid:84813185; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950082)"; flow:established,from_client; content:"GET"; http_method; content:"/xmrig-arm64-musl"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"207.244.234.243"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950082/; classtype:trojan-activity;sid:84813182; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950080)"; flow:established,from_client; content:"GET"; http_method; content:"/botnet.zip"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"151.242.30.142"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950080/; classtype:trojan-activity;sid:84813180; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950081)"; flow:established,from_client; content:"GET"; http_method; content:"/ddos.zip"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"151.242.30.142"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950081/; classtype:trojan-activity;sid:84813181; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950076)"; flow:established,from_client; content:"GET"; http_method; content:"/i686"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"66.29.151.122"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950076/; classtype:trojan-activity;sid:84813176; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950077)"; flow:established,from_client; content:"GET"; http_method; content:"/x86"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"66.29.151.122"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950077/; classtype:trojan-activity;sid:84813177; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950078)"; flow:established,from_client; content:"GET"; http_method; content:"/mipsel"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"66.29.151.122"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950078/; classtype:trojan-activity;sid:84813178; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950079)"; flow:established,from_client; content:"GET"; http_method; content:"/xmrig"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"15.204.85.94"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950079/; classtype:trojan-activity;sid:84813179; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950074)"; flow:established,from_client; content:"GET"; http_method; content:"/x86_64"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"66.29.151.122"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950074/; classtype:trojan-activity;sid:84813174; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950075)"; flow:established,from_client; content:"GET"; http_method; content:"/xmrig"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"207.244.234.243"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950075/; classtype:trojan-activity;sid:84813175; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950072)"; flow:established,from_client; content:"GET"; http_method; content:"/expshell.zip"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"151.242.30.142"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950072/; classtype:trojan-activity;sid:84813172; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950073)"; flow:established,from_client; content:"GET"; http_method; content:"/eclipse.arm"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"177.3.213.149"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950073/; classtype:trojan-activity;sid:84813173; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950071)"; flow:established,from_client; content:"GET"; http_method; content:"/eclipse.m68k"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"177.3.213.149"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950071/; classtype:trojan-activity;sid:84813171; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950067)"; flow:established,from_client; content:"GET"; http_method; content:"/libsyslog-arm64.so"; http_uri; depth:19; isdataat:!1,relative; nocase; content:"15.204.85.94"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950067/; classtype:trojan-activity;sid:84813167; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950068)"; flow:established,from_client; content:"GET"; http_method; content:"/mips"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"66.29.151.122"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950068/; classtype:trojan-activity;sid:84813168; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950069)"; flow:established,from_client; content:"GET"; http_method; content:"/cf_bypass.x86_64"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"129.159.135.190"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950069/; classtype:trojan-activity;sid:84813169; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950070)"; flow:established,from_client; content:"GET"; http_method; content:"/xmrig-patched"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"15.204.85.94"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950070/; classtype:trojan-activity;sid:84813170; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950066)"; flow:established,from_client; content:"GET"; http_method; content:"/exploit.js"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"151.242.30.142"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950066/; classtype:trojan-activity;sid:84813166; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950065)"; flow:established,from_client; content:"GET"; http_method; content:"/ssh_killer.x86_64"; http_uri; depth:18; isdataat:!1,relative; nocase; content:"129.159.135.190"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950065/; classtype:trojan-activity;sid:84813165; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950064)"; flow:established,from_client; content:"GET"; http_method; content:"/moonc2.zip"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"151.242.30.142"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950064/; classtype:trojan-activity;sid:84813164; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950061)"; flow:established,from_client; content:"GET"; http_method; content:"/mips"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"134.255.218.65"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950061/; classtype:trojan-activity;sid:84813161; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950062)"; flow:established,from_client; content:"GET"; http_method; content:"/downloads/nebulaclient-2.0.1.jar"; http_uri; depth:33; isdataat:!1,relative; nocase; content:"nebula-client.com"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950062/; classtype:trojan-activity;sid:84813162; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950063)"; flow:established,from_client; content:"GET"; http_method; content:"/ovh_specter.x86_64"; http_uri; depth:19; isdataat:!1,relative; nocase; content:"129.159.135.190"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950063/; classtype:trojan-activity;sid:84813163; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950052)"; flow:established,from_client; content:"GET"; http_method; content:"/botseo.js"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"151.242.30.142"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950052/; classtype:trojan-activity;sid:84813152; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950053)"; flow:established,from_client; content:"GET"; http_method; content:"/eclipse.mpsl"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"177.3.213.149"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950053/; classtype:trojan-activity;sid:84813153; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950054)"; flow:established,from_client; content:"GET"; http_method; content:"/ddosxkillping.zip"; http_uri; depth:18; isdataat:!1,relative; nocase; content:"151.242.30.142"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950054/; classtype:trojan-activity;sid:84813154; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950055)"; flow:established,from_client; content:"GET"; http_method; content:"/eclipse.arm5"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"177.3.213.149"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950055/; classtype:trojan-activity;sid:84813155; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950056)"; flow:established,from_client; content:"GET"; http_method; content:"/bots/mb.mipsle"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"96.62.71.5"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950056/; classtype:trojan-activity;sid:84813156; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950057)"; flow:established,from_client; content:"GET"; http_method; content:"/botnets.zip"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"151.242.30.142"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950057/; classtype:trojan-activity;sid:84813157; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950058)"; flow:established,from_client; content:"GET"; http_method; content:"/layer4.zip"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"151.242.30.142"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950058/; classtype:trojan-activity;sid:84813158; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950059)"; flow:established,from_client; content:"GET"; http_method; content:"/telexbotnet.zip"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"151.242.30.142"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950059/; classtype:trojan-activity;sid:84813159; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950060)"; flow:established,from_client; content:"GET"; http_method; content:"/dos.py"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"151.242.30.142"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950060/; classtype:trojan-activity;sid:84813160; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950048)"; flow:established,from_client; content:"GET"; http_method; content:"/flood_quantum.py"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"151.242.30.142"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950048/; classtype:trojan-activity;sid:84813148; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950049)"; flow:established,from_client; content:"GET"; http_method; content:"/eclipse.mips"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"177.3.213.149"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950049/; classtype:trojan-activity;sid:84813149; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950050)"; flow:established,from_client; content:"GET"; http_method; content:"/eclipse.ppc"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"177.3.213.149"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950050/; classtype:trojan-activity;sid:84813150; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950051)"; flow:established,from_client; content:"GET"; http_method; content:"/cfbypasser.py"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"151.242.30.142"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950051/; classtype:trojan-activity;sid:84813151; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950047)"; flow:established,from_client; content:"GET"; http_method; content:"/tcp.py"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"151.242.30.142"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950047/; classtype:trojan-activity;sid:84813147; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950045)"; flow:established,from_client; content:"GET"; http_method; content:"/eclipse.sh4"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"177.3.213.149"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950045/; classtype:trojan-activity;sid:84813145; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950046)"; flow:established,from_client; content:"GET"; http_method; content:"/eclipse.i686"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"177.3.213.149"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950046/; classtype:trojan-activity;sid:84813146; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950044)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"218.74.111.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950044/; classtype:trojan-activity;sid:84813144; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950043)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"124.130.8.34"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950043/; classtype:trojan-activity;sid:84813143; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950042)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.84.214.181"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950042/; classtype:trojan-activity;sid:84813142; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950041)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"120.84.231.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950041/; classtype:trojan-activity;sid:84813141; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950040)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.84.231.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950040/; classtype:trojan-activity;sid:84813140; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950038)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"221.14.174.24"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950038/; classtype:trojan-activity;sid:84813138; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950039)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"103.172.186.163"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950039/; classtype:trojan-activity;sid:84813139; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950037)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"196.189.68.239"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950037/; classtype:trojan-activity;sid:84813137; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950036)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"218.74.111.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950036/; classtype:trojan-activity;sid:84813136; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950035)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.52.81.24"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950035/; classtype:trojan-activity;sid:84813135; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950034)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.231.174.164"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950034/; classtype:trojan-activity;sid:84813134; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950033)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.58.176.160"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950033/; classtype:trojan-activity;sid:84813133; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950030)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"103.172.186.163"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950030/; classtype:trojan-activity;sid:84813130; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950031)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.160.0.30"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950031/; classtype:trojan-activity;sid:84813131; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950032)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.180.53.149"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950032/; classtype:trojan-activity;sid:84813132; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950029)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"219.157.238.6"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950029/; classtype:trojan-activity;sid:84813129; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950028)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.48.119.213"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950028/; classtype:trojan-activity;sid:84813128; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950027)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"113.160.0.30"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950027/; classtype:trojan-activity;sid:84813127; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950026)"; flow:established,from_client; content:"GET"; http_method; content:"/driverpack/hp_driverpack.rar"; http_uri; depth:29; isdataat:!1,relative; nocase; content:"ghost-new-live.ink"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950026/; classtype:trojan-activity;sid:84813126; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950024)"; flow:established,from_client; content:"GET"; http_method; content:"/dvnx.zip"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"cdd.omsules.life"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950024/; classtype:trojan-activity;sid:84813124; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950023)"; flow:established,from_client; content:"GET"; http_method; content:"/files/cheraxloader.rar"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"yimmenu.live"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950023/; classtype:trojan-activity;sid:84813123; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950022)"; flow:established,from_client; content:"GET"; http_method; content:"/elitefiles/elitecheatsx-2.0.zip"; http_uri; depth:32; isdataat:!1,relative; nocase; content:"www.elitecheatsx.live"; http_host; depth:21; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950022/; classtype:trojan-activity;sid:84813122; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950021)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"113.254.36.153"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950021/; classtype:trojan-activity;sid:84813121; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950020)"; flow:established,from_client; content:"GET"; http_method; content:"/uploads/download.zip"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"fairsexsecutor.xyz"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950020/; classtype:trojan-activity;sid:84813120; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950019)"; flow:established,from_client; content:"GET"; http_method; content:"/curl/qvien3y4pg/96ia76zt2cqcr1u6htij1l.dat"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"forge-ridge.com"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950019/; classtype:trojan-activity;sid:84813119; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950018)"; flow:established,from_client; content:"GET"; http_method; content:"/24/goodthingswithme.hta|3f|jpeg"; http_uri; depth:32; isdataat:!1,relative; nocase; content:"31.40.204.4"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950018/; classtype:trojan-activity;sid:84813118; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950017)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.156.249.210"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950017/; classtype:trojan-activity;sid:84813117; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950016)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.155.210.193"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950016/; classtype:trojan-activity;sid:84813116; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950014)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.57.229.125"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950014/; classtype:trojan-activity;sid:84813114; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950015)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"36.104.222.80"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950015/; classtype:trojan-activity;sid:84813115; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950013)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.214.62.213"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950013/; classtype:trojan-activity;sid:84813113; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950012)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"196.188.141.17"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950012/; classtype:trojan-activity;sid:84813112; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950011)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.230.187.105"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950011/; classtype:trojan-activity;sid:84813111; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950010)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.121.14.83"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950010/; classtype:trojan-activity;sid:84813110; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950009)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.191.233.24"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950009/; classtype:trojan-activity;sid:84813109; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950008)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"111.73.29.53"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950008/; classtype:trojan-activity;sid:84813108; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950007)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.230.187.105"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950007/; classtype:trojan-activity;sid:84813107; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950005)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.157.20.98"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950005/; classtype:trojan-activity;sid:84813105; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950006)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"103.172.186.194"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950006/; classtype:trojan-activity;sid:84813106; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950004)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.121.14.83"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950004/; classtype:trojan-activity;sid:84813104; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950003)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.18.111.216"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950003/; classtype:trojan-activity;sid:84813103; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950002)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.42.127.94"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950002/; classtype:trojan-activity;sid:84813102; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950001)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.14.174.24"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950001/; classtype:trojan-activity;sid:84813101; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3950000)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.157.208.27"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3950000/; classtype:trojan-activity;sid:84813100; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949999)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.28.144.161"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949999/; classtype:trojan-activity;sid:84813099; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949998)"; flow:established,from_client; content:"GET"; http_method; content:"/zljll.zip"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"82.23.246.75"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949998/; classtype:trojan-activity;sid:84813098; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949997)"; flow:established,from_client; content:"GET"; http_method; content:"/x.jpg"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"82.23.246.75"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949997/; classtype:trojan-activity;sid:84813097; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949996)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"120.28.144.161"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949996/; classtype:trojan-activity;sid:84813096; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949995)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.140.181.122"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949995/; classtype:trojan-activity;sid:84813095; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949994)"; flow:established,from_client; content:"GET"; http_method; content:"/ow.sh"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"wemqmewkqewq.work.gd"; http_host; depth:20; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949994/; classtype:trojan-activity;sid:84813094; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949993)"; flow:established,from_client; content:"GET"; http_method; content:"/amq.xml"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"wemqmewkqewq.work.gd"; http_host; depth:20; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949993/; classtype:trojan-activity;sid:84813093; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949992)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"171.221.41.6"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949992/; classtype:trojan-activity;sid:84813092; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949991)"; flow:established,from_client; content:"GET"; http_method; content:"/lyaon/1.tar.gz"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"up.sb"; http_host; depth:5; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949991/; classtype:trojan-activity;sid:84813091; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949990)"; flow:established,from_client; content:"GET"; http_method; content:"/installautostart.ps1"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"software.security-analyze.ltd"; http_host; depth:29; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949990/; classtype:trojan-activity;sid:84813090; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949987)"; flow:established,from_client; content:"GET"; http_method; content:"/lom3/0ad7a0bdad0aa13d"; http_uri; depth:22; isdataat:!1,relative; nocase; content:"cosmical2049.com"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949987/; classtype:trojan-activity;sid:84813087; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949988)"; flow:established,from_client; content:"GET"; http_method; content:"/faceitanalyze.ps1"; http_uri; depth:18; isdataat:!1,relative; nocase; content:"software.security-analyze.ltd"; http_host; depth:29; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949988/; classtype:trojan-activity;sid:84813088; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949989)"; flow:established,from_client; content:"GET"; http_method; content:"/game_library.dll"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"software.security-analyze.ltd"; http_host; depth:29; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949989/; classtype:trojan-activity;sid:84813089; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949986)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.165.86.197"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949986/; classtype:trojan-activity;sid:84813086; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949985)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.85.165.214"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949985/; classtype:trojan-activity;sid:84813085; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949984)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.87.170.153"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949984/; classtype:trojan-activity;sid:84813084; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949983)"; flow:established,from_client; content:"GET"; http_method; content:"/files/2145124153/4qnnrf8.exe"; http_uri; depth:29; isdataat:!1,relative; nocase; content:"62.60.226.140"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949983/; classtype:trojan-activity;sid:84813083; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949982)"; flow:established,from_client; content:"GET"; http_method; content:"/arm6"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"45.198.224.158"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949982/; classtype:trojan-activity;sid:84813082; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949981)"; flow:established,from_client; content:"GET"; http_method; content:"/spc"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"45.198.224.158"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949981/; classtype:trojan-activity;sid:84813081; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949980)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.165.86.197"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949980/; classtype:trojan-activity;sid:84813080; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949979)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.44.32.214"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949979/; classtype:trojan-activity;sid:84813079; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949978)"; flow:established,from_client; content:"GET"; http_method; content:"/dsound.dll"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"software.security-analyze.ltd"; http_host; depth:29; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949978/; classtype:trojan-activity;sid:84813078; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949976)"; flow:established,from_client; content:"GET"; http_method; content:"/grid-master"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"185.113.10.26"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949976/; classtype:trojan-activity;sid:84813076; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949977)"; flow:established,from_client; content:"GET"; http_method; content:"/grid-bot"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"185.113.10.26"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949977/; classtype:trojan-activity;sid:84813077; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949971)"; flow:established,from_client; content:"GET"; http_method; content:"/bot"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"185.113.10.26"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949971/; classtype:trojan-activity;sid:84813071; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949972)"; flow:established,from_client; content:"GET"; http_method; content:"/bot-armv5"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"185.113.10.26"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949972/; classtype:trojan-activity;sid:84813072; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949973)"; flow:established,from_client; content:"GET"; http_method; content:"/bot-mips"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"185.113.10.26"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949973/; classtype:trojan-activity;sid:84813073; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949974)"; flow:established,from_client; content:"GET"; http_method; content:"/bot-armv7"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"185.113.10.26"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949974/; classtype:trojan-activity;sid:84813074; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949975)"; flow:established,from_client; content:"GET"; http_method; content:"/bot-mipsle"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"185.113.10.26"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949975/; classtype:trojan-activity;sid:84813075; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949970)"; flow:established,from_client; content:"GET"; http_method; content:"/stress_max_armv7l"; http_uri; depth:18; isdataat:!1,relative; nocase; content:"185.117.91.6"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949970/; classtype:trojan-activity;sid:84813070; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949967)"; flow:established,from_client; content:"GET"; http_method; content:"/c2_server"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"185.117.91.6"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949967/; classtype:trojan-activity;sid:84813067; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949968)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_client_armv7l"; http_uri; depth:18; isdataat:!1,relative; nocase; content:"185.117.91.6"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949968/; classtype:trojan-activity;sid:84813068; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949969)"; flow:established,from_client; content:"GET"; http_method; content:"/armv7"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"185.117.91.6"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949969/; classtype:trojan-activity;sid:84813069; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949966)"; flow:established,from_client; content:"GET"; http_method; content:"/bot.arm7"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"185.117.91.6"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949966/; classtype:trojan-activity;sid:84813066; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949965)"; flow:established,from_client; content:"GET"; http_method; content:"/linux"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"47.92.205.158"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949965/; classtype:trojan-activity;sid:84813065; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949964)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"41.142.182.30"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949964/; classtype:trojan-activity;sid:84813064; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949963)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.165.81.114"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949963/; classtype:trojan-activity;sid:84813063; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949961)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.165.86.143"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949961/; classtype:trojan-activity;sid:84813061; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949962)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.148.153.185"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949962/; classtype:trojan-activity;sid:84813062; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949960)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.165.82.252"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949960/; classtype:trojan-activity;sid:84813060; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949959)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.15.14.153"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949959/; classtype:trojan-activity;sid:84813059; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949958)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"163.142.95.175"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949958/; classtype:trojan-activity;sid:84813058; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949955)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.228.219.239"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949955/; classtype:trojan-activity;sid:84813055; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949956)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"124.92.76.80"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949956/; classtype:trojan-activity;sid:84813056; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949957)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"170.84.133.235"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949957/; classtype:trojan-activity;sid:84813057; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949954)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.42.127.94"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949954/; classtype:trojan-activity;sid:84813054; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949953)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"88.235.97.150"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949953/; classtype:trojan-activity;sid:84813053; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949951)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"105.226.5.175"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949951/; classtype:trojan-activity;sid:84813051; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949952)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.226.5.175"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949952/; classtype:trojan-activity;sid:84813052; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949949)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.14.120.85"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949949/; classtype:trojan-activity;sid:84813049; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949950)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.14.120.85"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949950/; classtype:trojan-activity;sid:84813050; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949946)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.14.216.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949946/; classtype:trojan-activity;sid:84813046; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949947)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.202.122.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949947/; classtype:trojan-activity;sid:84813047; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949948)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.202.122.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949948/; classtype:trojan-activity;sid:84813048; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949945)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.19.210.176"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949945/; classtype:trojan-activity;sid:84813045; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949944)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.63.15.26"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949944/; classtype:trojan-activity;sid:84813044; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949943)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"103.44.136.115"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949943/; classtype:trojan-activity;sid:84813043; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949942)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.14.216.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949942/; classtype:trojan-activity;sid:84813042; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949941)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"154.223.128.222"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949941/; classtype:trojan-activity;sid:84813041; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949940)"; flow:established,from_client; content:"GET"; http_method; content:"/uc|3f|export=download|7c|26|7c|id=1ymxks5xzpkq_1ucb2nkdnuswwgh18oir"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"drive.google.com"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949940/; classtype:trojan-activity;sid:84813040; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949939)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.49.27.218"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949939/; classtype:trojan-activity;sid:84813039; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949938)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.a"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.107.208.199"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949938/; classtype:trojan-activity;sid:84813038; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949937)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.230.34.249"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949937/; classtype:trojan-activity;sid:84813037; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949935)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.238.241.44"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949935/; classtype:trojan-activity;sid:84813035; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949936)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"183.12.167.180"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949936/; classtype:trojan-activity;sid:84813036; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949934)"; flow:established,from_client; content:"GET"; http_method; content:"/test"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"api.9hits.com"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949934/; classtype:trojan-activity;sid:84813034; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949932)"; flow:established,from_client; content:"GET"; http_method; content:"/f/yhzuuxkyytoc-pr6sqaaqa/lvitjpau"; http_uri; depth:34; isdataat:!1,relative; nocase; content:"chantcompass9.com"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949932/; classtype:trojan-activity;sid:84813032; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949933)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.m"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"47.215.224.64"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949933/; classtype:trojan-activity;sid:84813033; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949930)"; flow:established,from_client; content:"GET"; http_method; content:"/curl/ltlmtyrcu/3idd7eprmh6is0juh3.json"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"chantcompass9.com"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949930/; classtype:trojan-activity;sid:84813030; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949931)"; flow:established,from_client; content:"GET"; http_method; content:"/dvnx.zip"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"cda.omsules.life"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949931/; classtype:trojan-activity;sid:84813031; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949929)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.239.159.114"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949929/; classtype:trojan-activity;sid:84813029; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949928)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"120.28.167.203"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949928/; classtype:trojan-activity;sid:84813028; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949926)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.m"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.24.87.31"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949926/; classtype:trojan-activity;sid:84813026; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949927)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.m"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"79.116.166.243"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949927/; classtype:trojan-activity;sid:84813027; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949925)"; flow:established,from_client; content:"GET"; http_method; content:"/mips"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"103.170.217.170"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949925/; classtype:trojan-activity;sid:84813025; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949923)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.138.116.13"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949923/; classtype:trojan-activity;sid:84813023; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949924)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.48.150.216"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949924/; classtype:trojan-activity;sid:84813024; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949921)"; flow:established,from_client; content:"GET"; http_method; content:"/static/c7e19b4a82d0.boot.js"; http_uri; depth:28; isdataat:!1,relative; nocase; content:"6sim.vip"; http_host; depth:8; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949921/; classtype:trojan-activity;sid:84813021; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949922)"; flow:established,from_client; content:"GET"; http_method; content:"/armv5"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"103.170.217.170"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949922/; classtype:trojan-activity;sid:84813022; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949919)"; flow:established,from_client; content:"GET"; http_method; content:"/x64"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"103.170.217.170"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949919/; classtype:trojan-activity;sid:84813019; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949920)"; flow:established,from_client; content:"GET"; http_method; content:"/pe/0cb19f768eb8cd92.js"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"dasdase13.icu"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949920/; classtype:trojan-activity;sid:84813020; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949918)"; flow:established,from_client; content:"GET"; http_method; content:"/arm64"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"103.170.217.170"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949918/; classtype:trojan-activity;sid:84813018; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949917)"; flow:established,from_client; content:"GET"; http_method; content:"/68993"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"23.94.252.153"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949917/; classtype:trojan-activity;sid:84813017; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949914)"; flow:established,from_client; content:"GET"; http_method; content:"/gooll/gooll.html"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"38.190.222.108"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949914/; classtype:trojan-activity;sid:84813014; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949915)"; flow:established,from_client; content:"GET"; http_method; content:"/gooll/49554fde7424c31c.js"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"38.190.222.108"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949915/; classtype:trojan-activity;sid:84813015; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949916)"; flow:established,from_client; content:"GET"; http_method; content:"/gooll/gooll.html"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"dasdase13.icu"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949916/; classtype:trojan-activity;sid:84813016; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949911)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1559223274288713738/1559628457460244631/bundle.zip|3f|ex=6acfc4b0|7c|26|7c|is=6ace7330|7c|26|7c|hm=790072cad2990b489449a7c54a60807741d8dafd1ba94c01fbd2175f24e47b3f|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949911/; classtype:trojan-activity;sid:84813011; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949912)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1485275138281836705/1559651858954326197/bundle_1.zip|3f|ex=6acfda7c|7c|26|7c|is=6ace88fc|7c|26|7c|hm=4e88eec75ac58db34a94f7bd03f514c06b3ab50fdf23ee9f33387c1e7e27d95d|7c|26|7c|"; http_uri; depth:188; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949912/; classtype:trojan-activity;sid:84813012; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949910)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1559204489343541351/1559205050075848734/bundle.zip|3f|ex=6acf8bdc|7c|26|7c|is=6ace3a5c|7c|26|7c|hm=17ced08c730d93caccc44403c84c2c4ff2207ebe0bf48d2aefebcadb2b1055bf|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949910/; classtype:trojan-activity;sid:84813010; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949909)"; flow:established,from_client; content:"GET"; http_method; content:"/blankgrabberrt/blankgrabberv2.03/raw/refs/heads/main/blank-grabber-main/blank%20grabber/builder.exe"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949909/; classtype:trojan-activity;sid:84813009; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949908)"; flow:established,from_client; content:"GET"; http_method; content:"/cd/0/get/dj8fa_3lsobukv1fm1ymmeysuvdqf2ynedh4g-4giko0nhxogowtdmaz05mmvbmfg8ig_f_s_cc2nhpztqp6kqnzyu7jlk7amixlpsuji6ysfgmx-u7tzfajh7vrwstd1bj5mgc9xr6ll-gtscuw11s7/file|3f|dl=1"; http_uri; depth:175; isdataat:!1,relative; nocase; content:"ucb795b953262a1f75be02669385.dl.dropboxusercontent.com"; http_host; depth:54; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949908/; classtype:trojan-activity;sid:84813008; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949906)"; flow:established,from_client; content:"GET"; http_method; content:"/pgtqejbexxngcq21ru4o0_peiiyzj0jezeuw2c-kijidrgump6kgsgqz6wfrwnsciqqyzfh8g3mneub42zfmfzv8abjvhlecwqdabdx28kw8ptpra5nsbox3xbl7rwrgicgmtlo1nhgt9eo_7bqot0hofkexfdbr5bzuav-pumw/h4y2tw5rhm9cdsr/term%5bi%5d-boot_p1.zip"; http_uri; depth:212; isdataat:!1,relative; nocase; content:"download2289.mediafire.com"; http_host; depth:26; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949906/; classtype:trojan-activity;sid:84813006; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949907)"; flow:established,from_client; content:"GET"; http_method; content:"/tr3rt76k8jlgbaingpforv1zrmodottej05defiuzww7cd2hx4vbu0xla5qxeh2vlq_zirzjhoww30cwan99oudgxfil60bvq5il9vrwkck4nfqnsl3tvywm_chqditb7mvubgkkjmkxf39a1h66192vifhzh_kmbnqx6mbr-jm/mmpdx5huea04hlf/r6-cheat-v1.3.rar"; http_uri; depth:206; isdataat:!1,relative; nocase; content:"download2290.mediafire.com"; http_host; depth:26; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949907/; classtype:trojan-activity;sid:84813007; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949905)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"103.44.136.115"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949905/; classtype:trojan-activity;sid:84813005; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949904)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"216.126.86.64"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949904/; classtype:trojan-activity;sid:84813004; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949903)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.11.204.176"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949903/; classtype:trojan-activity;sid:84813003; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949902)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.156.139.134"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949902/; classtype:trojan-activity;sid:84813002; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949900)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"5.165.233.43"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949900/; classtype:trojan-activity;sid:84813000; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949901)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"5.165.233.43"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949901/; classtype:trojan-activity;sid:84813001; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949899)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"46.236.65.9"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949899/; classtype:trojan-activity;sid:84812999; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949898)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"116.10.132.105"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949898/; classtype:trojan-activity;sid:84812998; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949897)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.53.200.62"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949897/; classtype:trojan-activity;sid:84812997; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949896)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.231.215.119"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949896/; classtype:trojan-activity;sid:84812996; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949893)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"105.184.198.135"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949893/; classtype:trojan-activity;sid:84812993; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949894)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.224.11.179"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949894/; classtype:trojan-activity;sid:84812994; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949895)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.53.240.35"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949895/; classtype:trojan-activity;sid:84812995; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949892)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.55.128.110"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949892/; classtype:trojan-activity;sid:84812992; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949891)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.49.27.218"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949891/; classtype:trojan-activity;sid:84812991; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949890)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.11.204.176"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949890/; classtype:trojan-activity;sid:84812990; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949889)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"61.166.61.44"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949889/; classtype:trojan-activity;sid:84812989; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949888)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"103.179.240.227"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949888/; classtype:trojan-activity;sid:84812988; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949887)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.126.207.149"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949887/; classtype:trojan-activity;sid:84812987; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949886)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.166.11.6"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949886/; classtype:trojan-activity;sid:84812986; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949885)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.204.195.222"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949885/; classtype:trojan-activity;sid:84812985; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949884)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.11.15.92"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949884/; classtype:trojan-activity;sid:84812984; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949882)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.179.215.124"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949882/; classtype:trojan-activity;sid:84812982; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949883)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"105.224.11.179"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949883/; classtype:trojan-activity;sid:84812983; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949881)"; flow:established,from_client; content:"GET"; http_method; content:"/divx.zip"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"rxb.immortales.fun"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949881/; classtype:trojan-activity;sid:84812981; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949877)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.235.55.70"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949877/; classtype:trojan-activity;sid:84812977; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949878)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.184.198.135"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949878/; classtype:trojan-activity;sid:84812978; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949879)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.235.72.7"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949879/; classtype:trojan-activity;sid:84812979; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949880)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"112.238.27.166"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949880/; classtype:trojan-activity;sid:84812980; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949876)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.204.195.222"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949876/; classtype:trojan-activity;sid:84812976; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949875)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"112.238.27.166"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949875/; classtype:trojan-activity;sid:84812975; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949874)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"112.248.252.138"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949874/; classtype:trojan-activity;sid:84812974; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949873)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.180.155.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949873/; classtype:trojan-activity;sid:84812973; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949872)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.84.213.141"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949872/; classtype:trojan-activity;sid:84812972; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949871)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.203.120.142"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949871/; classtype:trojan-activity;sid:84812971; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949870)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.127.251.169"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949870/; classtype:trojan-activity;sid:84812970; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949869)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.55.207.120"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949869/; classtype:trojan-activity;sid:84812969; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949868)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.161.90.221"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949868/; classtype:trojan-activity;sid:84812968; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949867)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.129.129.255"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949867/; classtype:trojan-activity;sid:84812967; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949866)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.55.48.84"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949866/; classtype:trojan-activity;sid:84812966; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949865)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"117.223.140.114"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949865/; classtype:trojan-activity;sid:84812965; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949864)"; flow:established,from_client; content:"GET"; http_method; content:"/download.php|3f|dl_t=5040be5331da9ad77144d7035ad44d7e|7c|26|7c|dl_e=1791728811|7c|26|7c|dl_s=6880545d8ab0d9b712a1206f40203fd50703bc111830d489f33cd79721666a8f"; http_uri; depth:158; isdataat:!1,relative; nocase; content:"onlocity.com"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949864/; classtype:trojan-activity;sid:84812964; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949863)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"119.114.62.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949863/; classtype:trojan-activity;sid:84812963; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949862)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.7.220.3"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949862/; classtype:trojan-activity;sid:84812962; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949861)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.203.238.103"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949861/; classtype:trojan-activity;sid:84812961; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949860)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"120.28.215.36"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949860/; classtype:trojan-activity;sid:84812960; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949858)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.116.36.37"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949858/; classtype:trojan-activity;sid:84812958; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949859)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"117.223.140.122"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949859/; classtype:trojan-activity;sid:84812959; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949857)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"120.84.213.141"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949857/; classtype:trojan-activity;sid:84812957; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949854)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"170.84.132.250"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949854/; classtype:trojan-activity;sid:84812954; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949855)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"119.186.205.150"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949855/; classtype:trojan-activity;sid:84812955; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949856)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.186.205.150"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949856/; classtype:trojan-activity;sid:84812956; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949852)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.12.234.153"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949852/; classtype:trojan-activity;sid:84812952; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949853)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"144.48.121.51"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949853/; classtype:trojan-activity;sid:84812953; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949851)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"130.12.209.153"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949851/; classtype:trojan-activity;sid:84812951; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949849)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.55.28.19"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949849/; classtype:trojan-activity;sid:84812949; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949850)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.55.48.84"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949850/; classtype:trojan-activity;sid:84812950; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949848)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.55.207.120"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949848/; classtype:trojan-activity;sid:84812948; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949846)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.177.100.35"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949846/; classtype:trojan-activity;sid:84812946; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949847)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.52.110.184"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949847/; classtype:trojan-activity;sid:84812947; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949845)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"78.38.19.164"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949845/; classtype:trojan-activity;sid:84812945; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949844)"; flow:established,from_client; content:"GET"; http_method; content:"/files/2145124153/d2ihif3.exe"; http_uri; depth:29; isdataat:!1,relative; nocase; content:"62.60.226.140"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949844/; classtype:trojan-activity;sid:84812944; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949843)"; flow:established,from_client; content:"GET"; http_method; content:"/files/2145124153/twn9rc1.exe"; http_uri; depth:29; isdataat:!1,relative; nocase; content:"62.60.226.140"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949843/; classtype:trojan-activity;sid:84812943; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949842)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"183.12.167.180"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949842/; classtype:trojan-activity;sid:84812942; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949841)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"117.223.143.4"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949841/; classtype:trojan-activity;sid:84812941; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949840)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"117.146.92.46"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949840/; classtype:trojan-activity;sid:84812940; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949823)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/mpsl"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"94.154.43.127"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949823/; classtype:trojan-activity;sid:84812923; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949824)"; flow:established,from_client; content:"GET"; http_method; content:"/ppc"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"45.198.224.158"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949824/; classtype:trojan-activity;sid:84812924; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949825)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/spc"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"94.154.43.127"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949825/; classtype:trojan-activity;sid:84812925; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949826)"; flow:established,from_client; content:"GET"; http_method; content:"/mipsel"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"45.198.224.158"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949826/; classtype:trojan-activity;sid:84812926; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949827)"; flow:established,from_client; content:"GET"; http_method; content:"/i686"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"45.198.224.158"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949827/; classtype:trojan-activity;sid:84812927; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949828)"; flow:established,from_client; content:"GET"; http_method; content:"/i586"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"45.198.224.158"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949828/; classtype:trojan-activity;sid:84812928; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949829)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/i686"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"94.154.43.127"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949829/; classtype:trojan-activity;sid:84812929; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949830)"; flow:established,from_client; content:"GET"; http_method; content:"/m68k"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"45.198.224.158"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949830/; classtype:trojan-activity;sid:84812930; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949831)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/x86_64"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"94.154.43.127"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949831/; classtype:trojan-activity;sid:84812931; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949832)"; flow:established,from_client; content:"GET"; http_method; content:"/x86_64"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"45.198.224.158"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949832/; classtype:trojan-activity;sid:84812932; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949833)"; flow:established,from_client; content:"GET"; http_method; content:"/arc"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"45.198.224.158"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949833/; classtype:trojan-activity;sid:84812933; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949834)"; flow:established,from_client; content:"GET"; http_method; content:"/mips"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"45.198.224.158"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949834/; classtype:trojan-activity;sid:84812934; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949835)"; flow:established,from_client; content:"GET"; http_method; content:"/arm7"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"45.198.224.158"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949835/; classtype:trojan-activity;sid:84812935; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949836)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/arm"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"94.154.43.127"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949836/; classtype:trojan-activity;sid:84812936; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949837)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/m68k"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"94.154.43.127"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949837/; classtype:trojan-activity;sid:84812937; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949838)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/mips"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"94.154.43.127"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949838/; classtype:trojan-activity;sid:84812938; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949839)"; flow:established,from_client; content:"GET"; http_method; content:"/arm"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"31.56.209.86"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949839/; classtype:trojan-activity;sid:84812939; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949819)"; flow:established,from_client; content:"GET"; http_method; content:"/sh4"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"45.198.224.158"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949819/; classtype:trojan-activity;sid:84812919; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949820)"; flow:established,from_client; content:"GET"; http_method; content:"/arm"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"45.198.224.158"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949820/; classtype:trojan-activity;sid:84812920; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949821)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/ppc"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"94.154.43.127"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949821/; classtype:trojan-activity;sid:84812921; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949822)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/arm6"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"94.154.43.127"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949822/; classtype:trojan-activity;sid:84812922; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949818)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/arm5"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"94.154.43.127"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949818/; classtype:trojan-activity;sid:84812918; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949817)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.179.6.215"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949817/; classtype:trojan-activity;sid:84812917; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949816)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.124.186.9"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949816/; classtype:trojan-activity;sid:84812916; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949815)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"59.97.250.49"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949815/; classtype:trojan-activity;sid:84812915; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949814)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.97.249.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949814/; classtype:trojan-activity;sid:84812914; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949813)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"117.146.92.46"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949813/; classtype:trojan-activity;sid:84812913; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949811)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.121.137.144"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949811/; classtype:trojan-activity;sid:84812911; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949812)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"117.63.242.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949812/; classtype:trojan-activity;sid:84812912; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949809)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"101.108.6.212"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949809/; classtype:trojan-activity;sid:84812909; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949810)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.121.208.153"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949810/; classtype:trojan-activity;sid:84812910; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949808)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"221.15.9.104"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949808/; classtype:trojan-activity;sid:84812908; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949807)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"216.129.184.213"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949807/; classtype:trojan-activity;sid:84812907; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949805)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.15.9.104"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949805/; classtype:trojan-activity;sid:84812905; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949806)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.137.20.110"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949806/; classtype:trojan-activity;sid:84812906; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949804)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"216.249.4.20"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_14; reference:url, urlhaus.abuse.ch/url/3949804/; classtype:trojan-activity;sid:84812904; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949803)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.86.75.61"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949803/; classtype:trojan-activity;sid:84812903; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949802)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.177.206.221"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949802/; classtype:trojan-activity;sid:84812902; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949800)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"101.108.6.212"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949800/; classtype:trojan-activity;sid:84812900; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949801)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.165.197.135"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949801/; classtype:trojan-activity;sid:84812901; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949798)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"116.138.106.90"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949798/; classtype:trojan-activity;sid:84812898; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949799)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"117.223.143.76"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949799/; classtype:trojan-activity;sid:84812899; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949797)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.52.68.113"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949797/; classtype:trojan-activity;sid:84812897; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949794)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.165.44.137"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949794/; classtype:trojan-activity;sid:84812894; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949795)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.113.206.3"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949795/; classtype:trojan-activity;sid:84812895; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949796)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.165.87.154"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949796/; classtype:trojan-activity;sid:84812896; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949793)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.28.135.254"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949793/; classtype:trojan-activity;sid:84812893; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949791)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.227.203.38"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949791/; classtype:trojan-activity;sid:84812891; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949792)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.224.145.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949792/; classtype:trojan-activity;sid:84812892; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949790)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"124.132.130.96"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949790/; classtype:trojan-activity;sid:84812890; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949789)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.52.68.113"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949789/; classtype:trojan-activity;sid:84812889; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949788)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"108.170.136.155"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949788/; classtype:trojan-activity;sid:84812888; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949787)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.116.49.51"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949787/; classtype:trojan-activity;sid:84812887; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949786)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.231.199.231"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949786/; classtype:trojan-activity;sid:84812886; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949785)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"108.170.136.155"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949785/; classtype:trojan-activity;sid:84812885; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949784)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.239.159.114"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949784/; classtype:trojan-activity;sid:84812884; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949783)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.146.7.79"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949783/; classtype:trojan-activity;sid:84812883; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949782)"; flow:established,from_client; content:"GET"; http_method; content:"/files/7782139129/9lfjbse.exe"; http_uri; depth:29; isdataat:!1,relative; nocase; content:"62.60.226.140"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949782/; classtype:trojan-activity;sid:84812882; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949781)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.180.138.228"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949781/; classtype:trojan-activity;sid:84812881; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949780)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.116.49.72"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949780/; classtype:trojan-activity;sid:84812880; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949779)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.147.248.105"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949779/; classtype:trojan-activity;sid:84812879; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949778)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.12.225.135"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949778/; classtype:trojan-activity;sid:84812878; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949777)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"113.231.199.231"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949777/; classtype:trojan-activity;sid:84812877; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949775)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.50.217.205"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949775/; classtype:trojan-activity;sid:84812875; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949776)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.49.29.100"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949776/; classtype:trojan-activity;sid:84812876; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949774)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.50.217.205"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949774/; classtype:trojan-activity;sid:84812874; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949773)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.121.154.159"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949773/; classtype:trojan-activity;sid:84812873; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949772)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.230.132.102"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949772/; classtype:trojan-activity;sid:84812872; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949771)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.230.132.102"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949771/; classtype:trojan-activity;sid:84812871; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949770)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"178.74.75.16"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949770/; classtype:trojan-activity;sid:84812870; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949769)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.146.7.79"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949769/; classtype:trojan-activity;sid:84812869; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949768)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"112.248.252.138"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949768/; classtype:trojan-activity;sid:84812868; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949767)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"170.84.134.172"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949767/; classtype:trojan-activity;sid:84812867; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949766)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.121.9.51"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949766/; classtype:trojan-activity;sid:84812866; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949765)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.219.74.191"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949765/; classtype:trojan-activity;sid:84812865; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949764)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.156.139.134"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949764/; classtype:trojan-activity;sid:84812864; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949763)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.12.244.201"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949763/; classtype:trojan-activity;sid:84812863; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949762)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.55.71.61"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949762/; classtype:trojan-activity;sid:84812862; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949761)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.165.84.138"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949761/; classtype:trojan-activity;sid:84812861; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949760)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.173.65.210"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949760/; classtype:trojan-activity;sid:84812860; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949757)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"110.186.230.140"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949757/; classtype:trojan-activity;sid:84812857; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949758)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.127.186.27"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949758/; classtype:trojan-activity;sid:84812858; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949759)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"183.48.166.223"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949759/; classtype:trojan-activity;sid:84812859; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949756)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.157.8.85"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949756/; classtype:trojan-activity;sid:84812856; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949755)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.112.93.63"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949755/; classtype:trojan-activity;sid:84812855; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949754)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"178.74.75.16"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949754/; classtype:trojan-activity;sid:84812854; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949753)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.113.39.174"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949753/; classtype:trojan-activity;sid:84812853; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949752)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"103.179.240.227"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949752/; classtype:trojan-activity;sid:84812852; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949751)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.46.198.146"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949751/; classtype:trojan-activity;sid:84812851; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949750)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"112.246.23.237"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949750/; classtype:trojan-activity;sid:84812850; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949749)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"154.223.128.222"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949749/; classtype:trojan-activity;sid:84812849; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949745)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"151.232.136.83"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949745/; classtype:trojan-activity;sid:84812845; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949746)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.225.25.165"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949746/; classtype:trojan-activity;sid:84812846; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949747)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.57.229.125"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949747/; classtype:trojan-activity;sid:84812847; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949748)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.61.111.244"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949748/; classtype:trojan-activity;sid:84812848; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949742)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"39.86.250.41"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949742/; classtype:trojan-activity;sid:84812842; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949743)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"116.3.202.164"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949743/; classtype:trojan-activity;sid:84812843; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949744)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"116.138.106.90"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949744/; classtype:trojan-activity;sid:84812844; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949741)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"83.219.1.198"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949741/; classtype:trojan-activity;sid:84812841; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949740)"; flow:established,from_client; content:"GET"; http_method; content:"/files/7299809293/g8wrnzp.exe"; http_uri; depth:29; isdataat:!1,relative; nocase; content:"62.60.226.140"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949740/; classtype:trojan-activity;sid:84812840; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949739)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.46.198.146"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949739/; classtype:trojan-activity;sid:84812839; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949738)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"59.58.114.244"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949738/; classtype:trojan-activity;sid:84812838; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949737)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"218.61.29.147"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949737/; classtype:trojan-activity;sid:84812837; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949736)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.224.56.184"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949736/; classtype:trojan-activity;sid:84812836; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949735)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.188.141.17"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949735/; classtype:trojan-activity;sid:84812835; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949734)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.55.57.11"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949734/; classtype:trojan-activity;sid:84812834; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949733)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.127.71.33"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949733/; classtype:trojan-activity;sid:84812833; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949732)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.5.14.37"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949732/; classtype:trojan-activity;sid:84812832; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949731)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.57.202.127"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949731/; classtype:trojan-activity;sid:84812831; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949730)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.114.62.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949730/; classtype:trojan-activity;sid:84812830; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949729)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.117.173.221"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949729/; classtype:trojan-activity;sid:84812829; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949727)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.122.120.82"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949727/; classtype:trojan-activity;sid:84812827; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949728)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.121.148.252"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949728/; classtype:trojan-activity;sid:84812828; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949726)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.116.112.72"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949726/; classtype:trojan-activity;sid:84812826; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949725)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/dlr.ppc"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"150.251.113.186"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949725/; classtype:trojan-activity;sid:84812825; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949724)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/dlr.m68k"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"150.251.113.186"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949724/; classtype:trojan-activity;sid:84812824; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949719)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/arm6"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"185.209.162.191"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949719/; classtype:trojan-activity;sid:84812819; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949720)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/dlr.mpsl"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"150.251.113.186"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949720/; classtype:trojan-activity;sid:84812820; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949721)"; flow:established,from_client; content:"GET"; http_method; content:"/main_mips"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"153.56.180.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949721/; classtype:trojan-activity;sid:84812821; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949722)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/dlr.arm5"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"150.251.113.186"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949722/; classtype:trojan-activity;sid:84812822; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949723)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/dlr.spc"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"150.251.113.186"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949723/; classtype:trojan-activity;sid:84812823; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949718)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"112.198.238.18"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949718/; classtype:trojan-activity;sid:84812818; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949717)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.13.30.219"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949717/; classtype:trojan-activity;sid:84812817; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949716)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"219.140.4.10"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949716/; classtype:trojan-activity;sid:84812816; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949715)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.14.40.123"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949715/; classtype:trojan-activity;sid:84812815; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949714)"; flow:established,from_client; content:"GET"; http_method; content:"/haha.bat"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"217.60.195.62"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949714/; classtype:trojan-activity;sid:84812814; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949713)"; flow:established,from_client; content:"GET"; http_method; content:"/shell.bat"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"217.60.195.62"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949713/; classtype:trojan-activity;sid:84812813; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949712)"; flow:established,from_client; content:"GET"; http_method; content:"/px.dat"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"217.60.195.62"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949712/; classtype:trojan-activity;sid:84812812; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949711)"; flow:established,from_client; content:"GET"; http_method; content:"/payload.vbs"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"217.60.195.62"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949711/; classtype:trojan-activity;sid:84812811; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949710)"; flow:established,from_client; content:"GET"; http_method; content:"/silent.vbs"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"217.60.195.62"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949710/; classtype:trojan-activity;sid:84812810; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949709)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"221.203.143.17"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949709/; classtype:trojan-activity;sid:84812809; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949708)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"210.208.106.68"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949708/; classtype:trojan-activity;sid:84812808; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949707)"; flow:established,from_client; content:"GET"; http_method; content:"/f/4nsri1yksbqlneewnevynq/cvfo3thd"; http_uri; depth:34; isdataat:!1,relative; nocase; content:"willow-13.com"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949707/; classtype:trojan-activity;sid:84812807; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949706)"; flow:established,from_client; content:"GET"; http_method; content:"/krypton-client.jar"; http_uri; depth:19; isdataat:!1,relative; nocase; content:"crackedclients.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949706/; classtype:trojan-activity;sid:84812806; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949705)"; flow:established,from_client; content:"GET"; http_method; content:"/curl/3q6bi119bmh/hta33q8o8pnbdlzpyl4v7e.dat"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"willow-13.com"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949705/; classtype:trojan-activity;sid:84812805; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949704)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"188.58.194.2"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949704/; classtype:trojan-activity;sid:84812804; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949703)"; flow:established,from_client; content:"GET"; http_method; content:"/kla.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"176.65.139.229"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949703/; classtype:trojan-activity;sid:84812803; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949702)"; flow:established,from_client; content:"GET"; http_method; content:"/bin/screenconnect.clientsetup.exe"; http_uri; depth:34; isdataat:!1,relative; nocase; content:"172.86.108.117"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949702/; classtype:trojan-activity;sid:84812802; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949701)"; flow:established,from_client; content:"GET"; http_method; content:"/bin/support.client.exe"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"172.86.108.117"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949701/; classtype:trojan-activity;sid:84812801; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949695)"; flow:established,from_client; content:"GET"; http_method; content:"/systemd"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"91.188.254.62"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949695/; classtype:trojan-activity;sid:84812795; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949696)"; flow:established,from_client; content:"GET"; http_method; content:"/akzmahazca/main_arm5"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"74.113.234.62"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949696/; classtype:trojan-activity;sid:84812796; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949697)"; flow:established,from_client; content:"GET"; http_method; content:"/akzmahazca/main_ppc"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"74.113.234.62"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949697/; classtype:trojan-activity;sid:84812797; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949698)"; flow:established,from_client; content:"GET"; http_method; content:"/akzmahazca/main_arm6"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"74.113.234.62"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949698/; classtype:trojan-activity;sid:84812798; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949699)"; flow:established,from_client; content:"GET"; http_method; content:"/akzmahazca/main_mips"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"74.113.234.62"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949699/; classtype:trojan-activity;sid:84812799; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949700)"; flow:established,from_client; content:"GET"; http_method; content:"/akzmahazca/main_x86_64"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"74.113.234.62"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949700/; classtype:trojan-activity;sid:84812800; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949694)"; flow:established,from_client; content:"GET"; http_method; content:"/akzmahazca/kz.sh"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"74.113.234.62"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949694/; classtype:trojan-activity;sid:84812794; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949693)"; flow:established,from_client; content:"GET"; http_method; content:"/akzmahazca/kaz.sh"; http_uri; depth:18; isdataat:!1,relative; nocase; content:"74.113.234.62"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949693/; classtype:trojan-activity;sid:84812793; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949686)"; flow:established,from_client; content:"GET"; http_method; content:"/akzmahazca/main_mpsl"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"74.113.234.62"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949686/; classtype:trojan-activity;sid:84812786; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949687)"; flow:established,from_client; content:"GET"; http_method; content:"/akzmahazca/main_sh4"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"74.113.234.62"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949687/; classtype:trojan-activity;sid:84812787; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949688)"; flow:established,from_client; content:"GET"; http_method; content:"/akzmahazca/main_x86"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"74.113.234.62"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949688/; classtype:trojan-activity;sid:84812788; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949689)"; flow:established,from_client; content:"GET"; http_method; content:"/akzmahazca/main_arm"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"74.113.234.62"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949689/; classtype:trojan-activity;sid:84812789; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949690)"; flow:established,from_client; content:"GET"; http_method; content:"/akzmahazca/main_arm7"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"74.113.234.62"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949690/; classtype:trojan-activity;sid:84812790; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949691)"; flow:established,from_client; content:"GET"; http_method; content:"/akzmahazca/main_arm64"; http_uri; depth:22; isdataat:!1,relative; nocase; content:"74.113.234.62"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949691/; classtype:trojan-activity;sid:84812791; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949692)"; flow:established,from_client; content:"GET"; http_method; content:"/akzmahazca/main_m68k"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"74.113.234.62"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949692/; classtype:trojan-activity;sid:84812792; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949685)"; flow:established,from_client; content:"GET"; http_method; content:"/b2f628/cronb.sh"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"104.244.76.33"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949685/; classtype:trojan-activity;sid:84812785; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949684)"; flow:established,from_client; content:"GET"; http_method; content:"/aurora.cooked.jar"; http_uri; depth:18; isdataat:!1,relative; nocase; content:"aurora-cooked.netlify.app"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949684/; classtype:trojan-activity;sid:84812784; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949683)"; flow:established,from_client; content:"GET"; http_method; content:"/armv5"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949683/; classtype:trojan-activity;sid:84812783; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949682)"; flow:established,from_client; content:"GET"; http_method; content:"/armv6"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949682/; classtype:trojan-activity;sid:84812782; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949681)"; flow:established,from_client; content:"GET"; http_method; content:"/mips64el"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"31.56.209.86"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949681/; classtype:trojan-activity;sid:84812781; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949680)"; flow:established,from_client; content:"GET"; http_method; content:"/x86"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"31.56.209.86"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949680/; classtype:trojan-activity;sid:84812780; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949676)"; flow:established,from_client; content:"GET"; http_method; content:"/dev.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"31.56.209.86"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949676/; classtype:trojan-activity;sid:84812776; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949677)"; flow:established,from_client; content:"GET"; http_method; content:"/cats.sh"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"31.56.209.86"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949677/; classtype:trojan-activity;sid:84812777; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949678)"; flow:established,from_client; content:"GET"; http_method; content:"/toto.sh"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"31.56.209.86"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949678/; classtype:trojan-activity;sid:84812778; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949679)"; flow:established,from_client; content:"GET"; http_method; content:"/kla.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"31.56.209.86"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949679/; classtype:trojan-activity;sid:84812779; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949675)"; flow:established,from_client; content:"GET"; http_method; content:"/ohshit.sh"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"176.65.139.76"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949675/; classtype:trojan-activity;sid:84812775; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949674)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.165.44.137"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949674/; classtype:trojan-activity;sid:84812774; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949672)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/mipsel"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"176.65.139.76"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949672/; classtype:trojan-activity;sid:84812772; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949673)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.165.80.226"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949673/; classtype:trojan-activity;sid:84812773; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949671)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.116.35.92"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949671/; classtype:trojan-activity;sid:84812771; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949669)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.121.221.214"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949669/; classtype:trojan-activity;sid:84812769; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949670)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"39.86.250.41"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949670/; classtype:trojan-activity;sid:84812770; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949668)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"178.205.231.127"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949668/; classtype:trojan-activity;sid:84812768; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949667)"; flow:established,from_client; content:"GET"; http_method; content:"/skid.arm6"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"176.65.139.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949667/; classtype:trojan-activity;sid:84812767; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949665)"; flow:established,from_client; content:"GET"; http_method; content:"/root"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"176.65.139.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949665/; classtype:trojan-activity;sid:84812765; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949666)"; flow:established,from_client; content:"GET"; http_method; content:"/skid.x86"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"176.65.139.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949666/; classtype:trojan-activity;sid:84812766; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949658)"; flow:established,from_client; content:"GET"; http_method; content:"/tplink.sh"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"176.65.139.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949658/; classtype:trojan-activity;sid:84812758; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949659)"; flow:established,from_client; content:"GET"; http_method; content:"/giga.sh"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"176.65.139.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949659/; classtype:trojan-activity;sid:84812759; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949660)"; flow:established,from_client; content:"GET"; http_method; content:"/massload"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"176.65.139.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949660/; classtype:trojan-activity;sid:84812760; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949661)"; flow:established,from_client; content:"GET"; http_method; content:"/toot"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"176.65.139.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949661/; classtype:trojan-activity;sid:84812761; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949662)"; flow:established,from_client; content:"GET"; http_method; content:"/dvr"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"176.65.139.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949662/; classtype:trojan-activity;sid:84812762; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949663)"; flow:established,from_client; content:"GET"; http_method; content:"/toto.sh"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"176.65.139.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949663/; classtype:trojan-activity;sid:84812763; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949664)"; flow:established,from_client; content:"GET"; http_method; content:"/l"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"176.65.139.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949664/; classtype:trojan-activity;sid:84812764; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949656)"; flow:established,from_client; content:"GET"; http_method; content:"/titanjr.arm7"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"176.65.139.135"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949656/; classtype:trojan-activity;sid:84812756; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949657)"; flow:established,from_client; content:"GET"; http_method; content:"/armv7l"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"176.65.139.135"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949657/; classtype:trojan-activity;sid:84812757; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949655)"; flow:established,from_client; content:"GET"; http_method; content:"/arm72"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"176.65.139.135"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949655/; classtype:trojan-activity;sid:84812755; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949654)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/dbg"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"176.65.139.209"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949654/; classtype:trojan-activity;sid:84812754; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949652)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"116.139.221.175"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949652/; classtype:trojan-activity;sid:84812752; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949653)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.7.100.85"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949653/; classtype:trojan-activity;sid:84812753; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949651)"; flow:established,from_client; content:"GET"; http_method; content:"/debug"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949651/; classtype:trojan-activity;sid:84812751; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949649)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.12.244.201"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949649/; classtype:trojan-activity;sid:84812749; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949650)"; flow:established,from_client; content:"GET"; http_method; content:"/l.sh"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949650/; classtype:trojan-activity;sid:84812750; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949648)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"178.205.231.127"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949648/; classtype:trojan-activity;sid:84812748; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949647)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.126.207.149"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949647/; classtype:trojan-activity;sid:84812747; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949646)"; flow:established,from_client; content:"GET"; http_method; content:"/s.sh"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949646/; classtype:trojan-activity;sid:84812746; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949645)"; flow:established,from_client; content:"GET"; http_method; content:"/main.mips"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"94.154.43.102"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949645/; classtype:trojan-activity;sid:84812745; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949641)"; flow:established,from_client; content:"GET"; http_method; content:"/main.x86"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"94.154.43.102"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949641/; classtype:trojan-activity;sid:84812741; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949642)"; flow:established,from_client; content:"GET"; http_method; content:"/main.mipsel"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"94.154.43.102"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949642/; classtype:trojan-activity;sid:84812742; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949643)"; flow:established,from_client; content:"GET"; http_method; content:"/main.x86_64"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"94.154.43.102"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949643/; classtype:trojan-activity;sid:84812743; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949644)"; flow:established,from_client; content:"GET"; http_method; content:"/main.armv7l"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"94.154.43.102"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949644/; classtype:trojan-activity;sid:84812744; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949639)"; flow:established,from_client; content:"GET"; http_method; content:"/arm6"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"176.65.139.160"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949639/; classtype:trojan-activity;sid:84812739; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949640)"; flow:established,from_client; content:"GET"; http_method; content:"/arm7"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"176.65.139.160"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949640/; classtype:trojan-activity;sid:84812740; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949638)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"220.168.239.21"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949638/; classtype:trojan-activity;sid:84812738; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949637)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.157.238.6"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949637/; classtype:trojan-activity;sid:84812737; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949636)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.23.236.153"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949636/; classtype:trojan-activity;sid:84812736; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949635)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"59.97.249.134"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949635/; classtype:trojan-activity;sid:84812735; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949634)"; flow:established,from_client; content:"GET"; http_method; content:"/android-arm64"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"176.65.139.151"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949634/; classtype:trojan-activity;sid:84812734; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949633)"; flow:established,from_client; content:"GET"; http_method; content:"/dl.sh"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"176.65.139.151"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949633/; classtype:trojan-activity;sid:84812733; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949625)"; flow:established,from_client; content:"GET"; http_method; content:"/launch.sh"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"176.65.139.151"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949625/; classtype:trojan-activity;sid:84812725; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949626)"; flow:established,from_client; content:"GET"; http_method; content:"/x86"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"176.65.139.151"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949626/; classtype:trojan-activity;sid:84812726; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949627)"; flow:established,from_client; content:"GET"; http_method; content:"/arm8"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"176.65.139.151"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949627/; classtype:trojan-activity;sid:84812727; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949628)"; flow:established,from_client; content:"GET"; http_method; content:"/riscv64"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"176.65.139.151"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949628/; classtype:trojan-activity;sid:84812728; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949629)"; flow:established,from_client; content:"GET"; http_method; content:"/riscv32"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"176.65.139.151"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949629/; classtype:trojan-activity;sid:84812729; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949630)"; flow:established,from_client; content:"GET"; http_method; content:"/ppc64"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"176.65.139.151"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949630/; classtype:trojan-activity;sid:84812730; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949631)"; flow:established,from_client; content:"GET"; http_method; content:"/s390x"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"176.65.139.151"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949631/; classtype:trojan-activity;sid:84812731; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949632)"; flow:established,from_client; content:"GET"; http_method; content:"/android-arm"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"176.65.139.151"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949632/; classtype:trojan-activity;sid:84812732; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949624)"; flow:established,from_client; content:"GET"; http_method; content:"/or1k"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"176.65.139.151"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949624/; classtype:trojan-activity;sid:84812724; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949623)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.7.100.85"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949623/; classtype:trojan-activity;sid:84812723; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949620)"; flow:established,from_client; content:"GET"; http_method; content:"/arm64"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"104.194.155.238"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949620/; classtype:trojan-activity;sid:84812720; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949621)"; flow:established,from_client; content:"GET"; http_method; content:"/arm5"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"104.194.155.238"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949621/; classtype:trojan-activity;sid:84812721; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949622)"; flow:established,from_client; content:"GET"; http_method; content:"/arm6"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"104.194.155.238"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949622/; classtype:trojan-activity;sid:84812722; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949614)"; flow:established,from_client; content:"GET"; http_method; content:"/amd64"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"104.194.155.238"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949614/; classtype:trojan-activity;sid:84812714; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949615)"; flow:established,from_client; content:"GET"; http_method; content:"/mipsle"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"104.194.155.238"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949615/; classtype:trojan-activity;sid:84812715; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949616)"; flow:established,from_client; content:"GET"; http_method; content:"/android_arm64"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"104.194.155.238"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949616/; classtype:trojan-activity;sid:84812716; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949617)"; flow:established,from_client; content:"GET"; http_method; content:"/arm"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"104.194.155.238"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949617/; classtype:trojan-activity;sid:84812717; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949618)"; flow:established,from_client; content:"GET"; http_method; content:"/mips"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"104.194.155.238"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949618/; classtype:trojan-activity;sid:84812718; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949619)"; flow:established,from_client; content:"GET"; http_method; content:"/armv7l"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"104.194.155.238"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949619/; classtype:trojan-activity;sid:84812719; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949610)"; flow:established,from_client; content:"GET"; http_method; content:"/bins.sh"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"104.194.155.238"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949610/; classtype:trojan-activity;sid:84812710; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949611)"; flow:established,from_client; content:"GET"; http_method; content:"/bot.exe"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"104.194.155.238"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949611/; classtype:trojan-activity;sid:84812711; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949612)"; flow:established,from_client; content:"GET"; http_method; content:"/i386"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"104.194.155.238"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949612/; classtype:trojan-activity;sid:84812712; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949613)"; flow:established,from_client; content:"GET"; http_method; content:"/x86"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"104.194.155.238"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949613/; classtype:trojan-activity;sid:84812713; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949609)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.23.238.153"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949609/; classtype:trojan-activity;sid:84812709; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949608)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"188.58.194.2"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949608/; classtype:trojan-activity;sid:84812708; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949607)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"210.208.110.20"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949607/; classtype:trojan-activity;sid:84812707; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949601)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.arm7"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"45.153.34.108"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949601/; classtype:trojan-activity;sid:84812701; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949602)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.sh4"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"45.153.34.108"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949602/; classtype:trojan-activity;sid:84812702; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949603)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.m68k"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"45.153.34.108"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949603/; classtype:trojan-activity;sid:84812703; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949604)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.mpsl"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"45.153.34.108"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949604/; classtype:trojan-activity;sid:84812704; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949605)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.arm6"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"45.153.34.108"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949605/; classtype:trojan-activity;sid:84812705; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949606)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.arm4"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"45.153.34.108"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949606/; classtype:trojan-activity;sid:84812706; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949597)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.ppc"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"45.153.34.108"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949597/; classtype:trojan-activity;sid:84812697; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949598)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.x86"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"45.153.34.108"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949598/; classtype:trojan-activity;sid:84812698; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949599)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.arm5"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"45.153.34.108"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949599/; classtype:trojan-activity;sid:84812699; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949600)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.mips"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"45.153.34.108"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949600/; classtype:trojan-activity;sid:84812700; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949596)"; flow:established,from_client; content:"GET"; http_method; content:"/polinex-clinet.jar"; http_uri; depth:19; isdataat:!1,relative; nocase; content:"skyblock-qol.com"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949596/; classtype:trojan-activity;sid:84812696; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949592)"; flow:established,from_client; content:"GET"; http_method; content:"/nebulaclientv3.1.7.jar"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"skyblock-qol.com"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949592/; classtype:trojan-activity;sid:84812692; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949593)"; flow:established,from_client; content:"GET"; http_method; content:"/pizzaloader.jar"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"skyblock-qol.com"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949593/; classtype:trojan-activity;sid:84812693; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949594)"; flow:established,from_client; content:"GET"; http_method; content:"/polarlauncher-v3.jar"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"skyblock-qol.com"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949594/; classtype:trojan-activity;sid:84812694; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949595)"; flow:established,from_client; content:"GET"; http_method; content:"/taunahiautopatch-b7-fabric.jar"; http_uri; depth:31; isdataat:!1,relative; nocase; content:"skyblock-qol.com"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949595/; classtype:trojan-activity;sid:84812695; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949591)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.40.86.124"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949591/; classtype:trojan-activity;sid:84812691; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949590)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.166.42.29"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949590/; classtype:trojan-activity;sid:84812690; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949589)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.202.112.18"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949589/; classtype:trojan-activity;sid:84812689; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949587)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.7.241.249"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949587/; classtype:trojan-activity;sid:84812687; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949588)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"82.114.178.6"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949588/; classtype:trojan-activity;sid:84812688; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949585)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"92.63.181.79"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949585/; classtype:trojan-activity;sid:84812685; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949586)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"92.248.175.43"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949586/; classtype:trojan-activity;sid:84812686; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949584)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.180.157.114"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949584/; classtype:trojan-activity;sid:84812684; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949583)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.14.145.195"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949583/; classtype:trojan-activity;sid:84812683; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949582)"; flow:established,from_client; content:"GET"; http_method; content:"/dvnx.zip"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"devs.kantales.life"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949582/; classtype:trojan-activity;sid:84812682; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949581)"; flow:established,from_client; content:"GET"; http_method; content:"/rat.exe"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"peterson-legislation-civilization-assistance.trycloudflare.com"; http_host; depth:62; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949581/; classtype:trojan-activity;sid:84812681; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949580)"; flow:established,from_client; content:"GET"; http_method; content:"/files/win_x64.exe"; http_uri; depth:18; isdataat:!1,relative; nocase; content:"139.99.90.3"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949580/; classtype:trojan-activity;sid:84812680; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949579)"; flow:established,from_client; content:"GET"; http_method; content:"/d/wxz_b2yrjysxjg"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"disk.360.yandex.ru"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949579/; classtype:trojan-activity;sid:84812679; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949578)"; flow:established,from_client; content:"GET"; http_method; content:"/ru/s/zm1clkr"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"fex.net"; http_host; depth:7; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949578/; classtype:trojan-activity;sid:84812678; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949572)"; flow:established,from_client; content:"GET"; http_method; content:"/yarn"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"45.153.34.108"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949572/; classtype:trojan-activity;sid:84812672; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949573)"; flow:established,from_client; content:"GET"; http_method; content:"/d/xcyvz"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"limewire.com"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949573/; classtype:trojan-activity;sid:84812673; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949574)"; flow:established,from_client; content:"GET"; http_method; content:"/run2"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"198.20.153.28"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949574/; classtype:trojan-activity;sid:84812674; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949575)"; flow:established,from_client; content:"GET"; http_method; content:"/susanbrownu640"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"linktr.ee"; http_host; depth:9; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949575/; classtype:trojan-activity;sid:84812675; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949576)"; flow:established,from_client; content:"GET"; http_method; content:"/r1jao/fyfeq.exe"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"sendit.sh"; http_host; depth:9; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949576/; classtype:trojan-activity;sid:84812676; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949568)"; flow:established,from_client; content:"GET"; http_method; content:"/test_drop_check"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"example.com"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949568/; classtype:trojan-activity;sid:84812668; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949569)"; flow:established,from_client; content:"GET"; http_method; content:"/py23.exe"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"filezilla.cc"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949569/; classtype:trojan-activity;sid:84812669; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949570)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949570/; classtype:trojan-activity;sid:84812670; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949571)"; flow:established,from_client; content:"GET"; http_method; content:"/files"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"139.99.90.3"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949571/; classtype:trojan-activity;sid:84812671; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949567)"; flow:established,from_client; content:"GET"; http_method; content:"/yesa6smw2dbggak_8snjlhgegxumxtmhf0sbdkppadcl276sftpazkotelrmhwdjps24sz-ugaz0ynbuodicuz84oh8hwldyj4vqhokmuuykyaynxeuypihkwz-ixzvrmxifmcl02siffj_xzbkp0cn4fgq49uctsk---70xyu8/54v6azoglpshzvq/programwin.zip"; http_uri; depth:203; isdataat:!1,relative; nocase; content:"download1475.mediafire.com"; http_host; depth:26; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949567/; classtype:trojan-activity;sid:84812667; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949566)"; flow:established,from_client; content:"GET"; http_method; content:"/download.php|3f|slug=gta-v-hack"; http_uri; depth:32; isdataat:!1,relative; nocase; content:"novagames.cc"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949566/; classtype:trojan-activity;sid:84812666; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949565)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"58.47.111.79"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949565/; classtype:trojan-activity;sid:84812665; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949564)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.96.140.120"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949564/; classtype:trojan-activity;sid:84812664; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949563)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"2.187.98.47"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949563/; classtype:trojan-activity;sid:84812663; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949562)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"216.129.184.213"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949562/; classtype:trojan-activity;sid:84812662; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949560)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"200.115.102.16"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949560/; classtype:trojan-activity;sid:84812660; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949561)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"210.208.111.26"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949561/; classtype:trojan-activity;sid:84812661; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949559)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.190.105.170"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949559/; classtype:trojan-activity;sid:84812659; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949558)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.18.213.171"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949558/; classtype:trojan-activity;sid:84812658; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949557)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.116.49.72"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949557/; classtype:trojan-activity;sid:84812657; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949556)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"220.198.115.115"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949556/; classtype:trojan-activity;sid:84812656; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949555)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.61.17.142"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949555/; classtype:trojan-activity;sid:84812655; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949554)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.18.213.171"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949554/; classtype:trojan-activity;sid:84812654; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949553)"; flow:established,from_client; content:"GET"; http_method; content:"/files-129312398/files/file_11c8dd9e257f0d09.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"91.92.242.236"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949553/; classtype:trojan-activity;sid:84812653; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949552)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.23.193.169"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949552/; classtype:trojan-activity;sid:84812652; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949551)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.150.177.183"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949551/; classtype:trojan-activity;sid:84812651; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949550)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.173.92.197"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949550/; classtype:trojan-activity;sid:84812650; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949549)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"196.189.197.131"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949549/; classtype:trojan-activity;sid:84812649; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949548)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.165.23.170"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949548/; classtype:trojan-activity;sid:84812648; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949546)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.224.153.218"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949546/; classtype:trojan-activity;sid:84812646; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949547)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"120.84.212.9"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949547/; classtype:trojan-activity;sid:84812647; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949545)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.23.193.169"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949545/; classtype:trojan-activity;sid:84812645; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949544)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.126.82.136"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949544/; classtype:trojan-activity;sid:84812644; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949543)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.160.112.104"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949543/; classtype:trojan-activity;sid:84812643; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949542)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.28.137.87"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949542/; classtype:trojan-activity;sid:84812642; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949541)"; flow:established,from_client; content:"GET"; http_method; content:"/z"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"138.124.59.179"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949541/; classtype:trojan-activity;sid:84812641; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949540)"; flow:established,from_client; content:"GET"; http_method; content:"/stage.sh"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"180.178.54.122"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949540/; classtype:trojan-activity;sid:84812640; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949539)"; flow:established,from_client; content:"GET"; http_method; content:"/mipsel"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"103.170.217.170"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949539/; classtype:trojan-activity;sid:84812639; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949538)"; flow:established,from_client; content:"GET"; http_method; content:"/armv7l"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"103.170.217.170"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949538/; classtype:trojan-activity;sid:84812638; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949536)"; flow:established,from_client; content:"GET"; http_method; content:"/armv5l"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"103.170.217.170"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949536/; classtype:trojan-activity;sid:84812636; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949537)"; flow:established,from_client; content:"GET"; http_method; content:"/x86"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"103.170.217.170"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949537/; classtype:trojan-activity;sid:84812637; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949535)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/payloads/o2.xml"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949535/; classtype:trojan-activity;sid:84812635; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949534)"; flow:established,from_client; content:"GET"; http_method; content:"/payload.py|3f|k=6805b2423ab6120a3c81d6b01e76fc36"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"31.56.53.160"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949534/; classtype:trojan-activity;sid:84812634; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949533)"; flow:established,from_client; content:"GET"; http_method; content:"/dk.sh"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"wemqmewkqewq.work.gd"; http_host; depth:20; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949533/; classtype:trojan-activity;sid:84812633; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949532)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.224.120.224"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949532/; classtype:trojan-activity;sid:84812632; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949529)"; flow:established,from_client; content:"GET"; http_method; content:"/d/432936b3a0439572/init.sh"; http_uri; depth:27; isdataat:!1,relative; nocase; content:"195.178.110.29"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949529/; classtype:trojan-activity;sid:84812629; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949530)"; flow:established,from_client; content:"GET"; http_method; content:"/beacon.sh|3f|k=6805b2423ab6120a3c81d6b01e76fc36"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"31.56.53.160"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949530/; classtype:trojan-activity;sid:84812630; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949531)"; flow:established,from_client; content:"GET"; http_method; content:"/beacon.sh|3f|k=6805b2423ab6120a3c81d6b0"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"31.56.53.160"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949531/; classtype:trojan-activity;sid:84812631; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949528)"; flow:established,from_client; content:"GET"; http_method; content:"/look/xmrig.bin"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"ftp.vietnam852.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949528/; classtype:trojan-activity;sid:84812628; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949525)"; flow:established,from_client; content:"GET"; http_method; content:"/index.html|3f|__cf_chl_tk=osf3rm32aasffprl5_0jc.py4brfresr-hps-jidlcoic7urefleeufvgdfo30yw5vt43bbahowc8fgg-1791893877-1.0.1.1-i9kwpgvr.7omlljwf2zu"; http_uri; depth:147; isdataat:!1,relative; nocase; content:"pub-0bf4d4ca8a6e426ea7d3d00ec3ecd192.r2.dev"; http_host; depth:43; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949525/; classtype:trojan-activity;sid:84812625; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949526)"; flow:established,from_client; content:"GET"; http_method; content:"/payload.py|3f|k=6805b2423ab6120"; http_uri; depth:32; isdataat:!1,relative; nocase; content:"31.56.53.160"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949526/; classtype:trojan-activity;sid:84812626; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949527)"; flow:established,from_client; content:"GET"; http_method; content:"/index.html|3f|__cf_chl_tk=jjxcko48du7z4jaebhydyrypaur9pqniiwzts7omgmgisaydnyx6qtcaackwy9gtukdt5lb64s-.xcnt-1791893987-1.0.1.1-ggoyelstvnwtzbkzqedh"; http_uri; depth:147; isdataat:!1,relative; nocase; content:"pub-0bf4d4ca8a6e426ea7d3d00ec3ecd192.r2.dev"; http_host; depth:43; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949527/; classtype:trojan-activity;sid:84812627; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949524)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/payloads/o.xml"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949524/; classtype:trojan-activity;sid:84812624; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949523)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"124.234.0.3"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949523/; classtype:trojan-activity;sid:84812623; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949522)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"117.63.188.199"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949522/; classtype:trojan-activity;sid:84812622; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949521)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.44.144.143"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949521/; classtype:trojan-activity;sid:84812621; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949520)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"117.26.72.241"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949520/; classtype:trojan-activity;sid:84812620; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949519)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.165.83.112"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949519/; classtype:trojan-activity;sid:84812619; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949517)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.165.83.112"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949517/; classtype:trojan-activity;sid:84812617; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949518)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.166.11.6"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949518/; classtype:trojan-activity;sid:84812618; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949516)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.5.126.3"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949516/; classtype:trojan-activity;sid:84812616; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949513)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.178.220.88"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949513/; classtype:trojan-activity;sid:84812613; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949514)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.224.77.32"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949514/; classtype:trojan-activity;sid:84812614; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949515)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.239.224.109"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949515/; classtype:trojan-activity;sid:84812615; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949512)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"120.28.137.87"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949512/; classtype:trojan-activity;sid:84812612; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949511)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.7.200.212"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949511/; classtype:trojan-activity;sid:84812611; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949510)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"124.234.0.3"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949510/; classtype:trojan-activity;sid:84812610; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949509)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"70.166.118.40"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949509/; classtype:trojan-activity;sid:84812609; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949507)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"39.87.37.204"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949507/; classtype:trojan-activity;sid:84812607; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949508)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.124.19.237"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949508/; classtype:trojan-activity;sid:84812608; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949504)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"39.90.144.65"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949504/; classtype:trojan-activity;sid:84812604; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949505)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.54.43.231"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949505/; classtype:trojan-activity;sid:84812605; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949506)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"39.87.37.204"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949506/; classtype:trojan-activity;sid:84812606; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949503)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.42.32.7"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949503/; classtype:trojan-activity;sid:84812603; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949502)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.138.101.246"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949502/; classtype:trojan-activity;sid:84812602; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949501)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.220.121.135"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949501/; classtype:trojan-activity;sid:84812601; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949500)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.238.173.112"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949500/; classtype:trojan-activity;sid:84812600; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949497)"; flow:established,from_client; content:"GET"; http_method; content:"/main_x86_64"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"153.56.180.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949497/; classtype:trojan-activity;sid:84812597; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949498)"; flow:established,from_client; content:"GET"; http_method; content:"/main_x86"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"153.56.180.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949498/; classtype:trojan-activity;sid:84812598; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949499)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/arm5"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"185.209.162.191"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949499/; classtype:trojan-activity;sid:84812599; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949488)"; flow:established,from_client; content:"GET"; http_method; content:"/arm"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"176.65.139.151"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949488/; classtype:trojan-activity;sid:84812588; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949489)"; flow:established,from_client; content:"GET"; http_method; content:"/mipsel"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"176.65.139.151"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949489/; classtype:trojan-activity;sid:84812589; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949490)"; flow:established,from_client; content:"GET"; http_method; content:"/arm7"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"185.209.162.191"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949490/; classtype:trojan-activity;sid:84812590; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949491)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/mpsl"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"185.209.162.191"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949491/; classtype:trojan-activity;sid:84812591; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949492)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/mips"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"185.209.162.191"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949492/; classtype:trojan-activity;sid:84812592; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949493)"; flow:established,from_client; content:"GET"; http_method; content:"/main_arm"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"153.56.180.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949493/; classtype:trojan-activity;sid:84812593; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949494)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sh4"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"185.209.162.191"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949494/; classtype:trojan-activity;sid:84812594; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949495)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/x86_64"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"185.209.162.191"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949495/; classtype:trojan-activity;sid:84812595; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949496)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/m68k"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"185.209.162.191"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949496/; classtype:trojan-activity;sid:84812596; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949487)"; flow:established,from_client; content:"GET"; http_method; content:"/spc"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"185.209.162.191"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949487/; classtype:trojan-activity;sid:84812587; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949485)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/ppc"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"185.209.162.191"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949485/; classtype:trojan-activity;sid:84812585; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949486)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/arm7"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"185.209.162.191"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949486/; classtype:trojan-activity;sid:84812586; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949484)"; flow:established,from_client; content:"GET"; http_method; content:"/main_arm6"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"153.56.180.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949484/; classtype:trojan-activity;sid:84812584; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949480)"; flow:established,from_client; content:"GET"; http_method; content:"/arm6"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"185.209.162.191"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949480/; classtype:trojan-activity;sid:84812580; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949481)"; flow:established,from_client; content:"GET"; http_method; content:"/arm/"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"185.209.162.191"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949481/; classtype:trojan-activity;sid:84812581; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949482)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/spc"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"185.209.162.191"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949482/; classtype:trojan-activity;sid:84812582; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949483)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/arm"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"185.209.162.191"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949483/; classtype:trojan-activity;sid:84812583; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949478)"; flow:established,from_client; content:"GET"; http_method; content:"/ppc"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"185.209.162.191"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949478/; classtype:trojan-activity;sid:84812578; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949479)"; flow:established,from_client; content:"GET"; http_method; content:"/mips"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"185.209.162.191"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949479/; classtype:trojan-activity;sid:84812579; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949477)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.186.199.209"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949477/; classtype:trojan-activity;sid:84812577; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949476)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"78.160.205.52"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949476/; classtype:trojan-activity;sid:84812576; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949475)"; flow:established,from_client; content:"GET"; http_method; content:"/files-129312398/files/file_4e3366830d6d5b4b.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"91.92.242.236"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949475/; classtype:trojan-activity;sid:84812575; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949473)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.127.64.151"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949473/; classtype:trojan-activity;sid:84812573; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949474)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.127.0.237"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949474/; classtype:trojan-activity;sid:84812574; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949472)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"219.154.182.123"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949472/; classtype:trojan-activity;sid:84812572; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949471)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"59.96.142.1"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949471/; classtype:trojan-activity;sid:84812571; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949470)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"124.6.169.54"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949470/; classtype:trojan-activity;sid:84812570; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949469)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"45.186.210.138"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949469/; classtype:trojan-activity;sid:84812569; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949468)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.55.37.26"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949468/; classtype:trojan-activity;sid:84812568; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949463)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.224.153.218"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949463/; classtype:trojan-activity;sid:84812563; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949464)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.178.31.252"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949464/; classtype:trojan-activity;sid:84812564; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949465)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"112.248.63.187"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949465/; classtype:trojan-activity;sid:84812565; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949466)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.175.197.28"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949466/; classtype:trojan-activity;sid:84812566; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949467)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.14.145.195"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949467/; classtype:trojan-activity;sid:84812567; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949462)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.129.133.185"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949462/; classtype:trojan-activity;sid:84812562; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949461)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.189.35.226"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949461/; classtype:trojan-activity;sid:84812561; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949460)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.55.37.26"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949460/; classtype:trojan-activity;sid:84812560; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949459)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.49.31.210"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949459/; classtype:trojan-activity;sid:84812559; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949457)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.116.36.138"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949457/; classtype:trojan-activity;sid:84812557; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949458)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.116.36.138"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949458/; classtype:trojan-activity;sid:84812558; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949456)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.12.173.255"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949456/; classtype:trojan-activity;sid:84812556; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949455)"; flow:established,from_client; content:"GET"; http_method; content:"/linux"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"47.76.71.217"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949455/; classtype:trojan-activity;sid:84812555; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949454)"; flow:established,from_client; content:"GET"; http_method; content:"/s/amd64"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"31.56.209.73"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949454/; classtype:trojan-activity;sid:84812554; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949453)"; flow:established,from_client; content:"GET"; http_method; content:"/s/kswpad"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"31.56.209.73"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949453/; classtype:trojan-activity;sid:84812553; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949452)"; flow:established,from_client; content:"GET"; http_method; content:"/s/kal64"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"31.56.209.73"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949452/; classtype:trojan-activity;sid:84812552; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949447)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/mpsl"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"83.168.110.24"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949447/; classtype:trojan-activity;sid:84812547; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949448)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/mips"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"83.168.110.24"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949448/; classtype:trojan-activity;sid:84812548; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949449)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/arm7"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"83.168.110.24"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949449/; classtype:trojan-activity;sid:84812549; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949450)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/x86_64"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"83.168.110.24"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949450/; classtype:trojan-activity;sid:84812550; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949451)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/arm"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"83.168.110.24"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949451/; classtype:trojan-activity;sid:84812551; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949446)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"196.189.35.226"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949446/; classtype:trojan-activity;sid:84812546; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949445)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.28.215.36"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949445/; classtype:trojan-activity;sid:84812545; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949444)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"105.225.40.144"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949444/; classtype:trojan-activity;sid:84812544; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949443)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.231.251.190"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949443/; classtype:trojan-activity;sid:84812543; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949442)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.225.63.96"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949442/; classtype:trojan-activity;sid:84812542; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949441)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"190.109.227.192"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949441/; classtype:trojan-activity;sid:84812541; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949437)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.231.232.118"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949437/; classtype:trojan-activity;sid:84812537; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949438)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.232.224.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949438/; classtype:trojan-activity;sid:84812538; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949439)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.231.232.118"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949439/; classtype:trojan-activity;sid:84812539; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949440)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.84.214.199"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949440/; classtype:trojan-activity;sid:84812540; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949436)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.165.81.57"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949436/; classtype:trojan-activity;sid:84812536; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949435)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.165.81.57"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949435/; classtype:trojan-activity;sid:84812535; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949434)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.m"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"202.47.54.175"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949434/; classtype:trojan-activity;sid:84812534; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949433)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/payloads/wget.sh"; http_uri; depth:22; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949433/; classtype:trojan-activity;sid:84812533; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949432)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.124.12.142"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949432/; classtype:trojan-activity;sid:84812532; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949430)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.64.219.249"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949430/; classtype:trojan-activity;sid:84812530; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949431)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"196.64.219.249"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949431/; classtype:trojan-activity;sid:84812531; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949429)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.12.234.153"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949429/; classtype:trojan-activity;sid:84812529; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949428)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.238.241.44"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949428/; classtype:trojan-activity;sid:84812528; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949427)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.155.234.19"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949427/; classtype:trojan-activity;sid:84812527; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949425)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.238.248.174"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949425/; classtype:trojan-activity;sid:84812525; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949426)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.4.97.14"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949426/; classtype:trojan-activity;sid:84812526; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949424)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"210.208.110.221"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949424/; classtype:trojan-activity;sid:84812524; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949423)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.156.19.56"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949423/; classtype:trojan-activity;sid:84812523; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949422)"; flow:established,from_client; content:"GET"; http_method; content:"/tribot.jar"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"www.tribot.co.uk"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949422/; classtype:trojan-activity;sid:84812522; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949421)"; flow:established,from_client; content:"GET"; http_method; content:"/d/432936b3a0439572/o/geeef/init.sh"; http_uri; depth:35; isdataat:!1,relative; nocase; content:"195.178.110.29"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949421/; classtype:trojan-activity;sid:84812521; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949420)"; flow:established,from_client; content:"GET"; http_method; content:"/pethelper.apk"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"benzinclick.live"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949420/; classtype:trojan-activity;sid:84812520; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949419)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.119.221.187"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949419/; classtype:trojan-activity;sid:84812519; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949418)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"219.156.19.56"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949418/; classtype:trojan-activity;sid:84812518; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949417)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"46.163.181.104"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949417/; classtype:trojan-activity;sid:84812517; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949415)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"221.15.94.127"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949415/; classtype:trojan-activity;sid:84812515; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949416)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.7.234.176"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949416/; classtype:trojan-activity;sid:84812516; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949414)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"59.96.141.163"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949414/; classtype:trojan-activity;sid:84812514; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949411)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.97.255.67"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949411/; classtype:trojan-activity;sid:84812511; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949412)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"219.157.65.180"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949412/; classtype:trojan-activity;sid:84812512; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949413)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.96.141.163"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949413/; classtype:trojan-activity;sid:84812513; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949410)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.157.65.180"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949410/; classtype:trojan-activity;sid:84812510; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949409)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"221.15.185.45"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949409/; classtype:trojan-activity;sid:84812509; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949408)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.226.5.151"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949408/; classtype:trojan-activity;sid:84812508; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949407)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.165.86.250"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949407/; classtype:trojan-activity;sid:84812507; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949406)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.25.71.38"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949406/; classtype:trojan-activity;sid:84812506; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949405)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.165.86.250"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949405/; classtype:trojan-activity;sid:84812505; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949404)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.119.197.98"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949404/; classtype:trojan-activity;sid:84812504; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949403)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.14.210.153"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949403/; classtype:trojan-activity;sid:84812503; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949402)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.113.206.3"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949402/; classtype:trojan-activity;sid:84812502; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949400)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.13.30.219"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949400/; classtype:trojan-activity;sid:84812500; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949401)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.189.205.161"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949401/; classtype:trojan-activity;sid:84812501; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949399)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"94.244.36.34"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949399/; classtype:trojan-activity;sid:84812499; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949398)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.147.231.18"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949398/; classtype:trojan-activity;sid:84812498; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949397)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"114.227.64.135"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949397/; classtype:trojan-activity;sid:84812497; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949396)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"114.227.64.135"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949396/; classtype:trojan-activity;sid:84812496; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949395)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"105.226.5.151"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949395/; classtype:trojan-activity;sid:84812495; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949394)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"124.132.130.96"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949394/; classtype:trojan-activity;sid:84812494; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949393)"; flow:established,from_client; content:"GET"; http_method; content:"/majorraikage45/mimilokinil/releases/download/v2.6/loader.v2.6.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949393/; classtype:trojan-activity;sid:84812493; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949392)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"94.244.36.34"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949392/; classtype:trojan-activity;sid:84812492; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949391)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"112.248.63.187"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949391/; classtype:trojan-activity;sid:84812491; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949390)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"45.163.85.239"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949390/; classtype:trojan-activity;sid:84812490; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949388)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"45.163.85.239"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949388/; classtype:trojan-activity;sid:84812488; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949389)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"45.186.210.138"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949389/; classtype:trojan-activity;sid:84812489; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949387)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.14.40.123"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949387/; classtype:trojan-activity;sid:84812487; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949386)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.147.231.18"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949386/; classtype:trojan-activity;sid:84812486; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949385)"; flow:established,from_client; content:"GET"; http_method; content:"/31aa8434-bc4d-511f-910d-adbab2766b4f"; http_uri; depth:37; isdataat:!1,relative; nocase; content:"aafesorder.com"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949385/; classtype:trojan-activity;sid:84812485; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949384)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"180.188.142.1"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949384/; classtype:trojan-activity;sid:84812484; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949383)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.m"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.153.133.229"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949383/; classtype:trojan-activity;sid:84812483; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949382)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/dbg"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"45.135.194.96"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949382/; classtype:trojan-activity;sid:84812482; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949381)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"38.46.31.127"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949381/; classtype:trojan-activity;sid:84812481; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949380)"; flow:established,from_client; content:"GET"; http_method; content:"/pkgfkmn.txt"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"104.223.84.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949380/; classtype:trojan-activity;sid:84812480; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949379)"; flow:established,from_client; content:"GET"; http_method; content:"/rkgoaok.txt"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"104.223.84.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949379/; classtype:trojan-activity;sid:84812479; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949377)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.154.111.213"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949377/; classtype:trojan-activity;sid:84812477; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949378)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"220.198.115.233"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949378/; classtype:trojan-activity;sid:84812478; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949376)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"105.187.30.24"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949376/; classtype:trojan-activity;sid:84812476; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949375)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"180.188.142.1"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949375/; classtype:trojan-activity;sid:84812475; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949373)"; flow:established,from_client; content:"GET"; http_method; content:"/p"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"stat.bestcompliance.net"; http_host; depth:23; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949373/; classtype:trojan-activity;sid:84812473; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949374)"; flow:established,from_client; content:"GET"; http_method; content:"/s"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"stat.bestcompliance.net"; http_host; depth:23; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949374/; classtype:trojan-activity;sid:84812474; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949372)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.225.40.144"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949372/; classtype:trojan-activity;sid:84812472; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949370)"; flow:established,from_client; content:"GET"; http_method; content:"/js/pp10.bin"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"bvmatqnam.com.vn"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949370/; classtype:trojan-activity;sid:84812470; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949371)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.84.214.205"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949371/; classtype:trojan-activity;sid:84812471; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949369)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"116.139.221.175"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949369/; classtype:trojan-activity;sid:84812469; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949368)"; flow:established,from_client; content:"GET"; http_method; content:"/js/see3.ps1"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"bvmatqnam.com.vn"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949368/; classtype:trojan-activity;sid:84812468; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949367)"; flow:established,from_client; content:"GET"; http_method; content:"/js/tt3.txt"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"bvmatqnam.com.vn"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949367/; classtype:trojan-activity;sid:84812467; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949363)"; flow:established,from_client; content:"GET"; http_method; content:"/armv6l"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"45.137.70.17"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949363/; classtype:trojan-activity;sid:84812463; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949364)"; flow:established,from_client; content:"GET"; http_method; content:"/powerpc"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"45.137.70.17"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949364/; classtype:trojan-activity;sid:84812464; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949365)"; flow:established,from_client; content:"GET"; http_method; content:"/sh4"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"45.137.70.17"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949365/; classtype:trojan-activity;sid:84812465; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949366)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/bot.ppc440"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"143.20.154.42"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949366/; classtype:trojan-activity;sid:84812466; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949362)"; flow:established,from_client; content:"GET"; http_method; content:"/linux"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"121.229.202.198"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949362/; classtype:trojan-activity;sid:84812462; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949361)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.153.133.229"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949361/; classtype:trojan-activity;sid:84812461; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949360)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"196.189.98.110"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949360/; classtype:trojan-activity;sid:84812460; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949359)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.23.234.57"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949359/; classtype:trojan-activity;sid:84812459; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949357)"; flow:established,from_client; content:"GET"; http_method; content:"/aether-1.3.1-26.1.2.jar"; http_uri; depth:24; isdataat:!1,relative; nocase; content:"polinex.org"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949357/; classtype:trojan-activity;sid:84812457; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949358)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.40.153.104"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949358/; classtype:trojan-activity;sid:84812458; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949356)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.m"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"105.225.69.120"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949356/; classtype:trojan-activity;sid:84812456; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949354)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"114.227.63.225"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949354/; classtype:trojan-activity;sid:84812454; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949355)"; flow:established,from_client; content:"GET"; http_method; content:"/beamtech-1.1.8-mc26.1.2.jar"; http_uri; depth:28; isdataat:!1,relative; nocase; content:"beamtechmacros.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949355/; classtype:trojan-activity;sid:84812455; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949353)"; flow:established,from_client; content:"GET"; http_method; content:"/beamtech-1.1.8-mc26.2.jar"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"beamtechmacros.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949353/; classtype:trojan-activity;sid:84812453; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949352)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.56.177.207"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949352/; classtype:trojan-activity;sid:84812452; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949350)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.m"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"216.126.80.56"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949350/; classtype:trojan-activity;sid:84812450; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949351)"; flow:established,from_client; content:"GET"; http_method; content:"/snypesh.sh"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949351/; classtype:trojan-activity;sid:84812451; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949349)"; flow:established,from_client; content:"GET"; http_method; content:"/f/cbjjtwu7"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"csgroup.host"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949349/; classtype:trojan-activity;sid:84812449; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949338)"; flow:established,from_client; content:"GET"; http_method; content:"/i686"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"45.137.70.17"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949338/; classtype:trojan-activity;sid:84812438; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949339)"; flow:established,from_client; content:"GET"; http_method; content:"/m68k"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"45.137.70.17"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949339/; classtype:trojan-activity;sid:84812439; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949340)"; flow:established,from_client; content:"GET"; http_method; content:"/eksgbins.sh"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"45.137.70.17"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949340/; classtype:trojan-activity;sid:84812440; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949341)"; flow:established,from_client; content:"GET"; http_method; content:"/mips"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"45.137.70.17"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949341/; classtype:trojan-activity;sid:84812441; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949342)"; flow:established,from_client; content:"GET"; http_method; content:"/armv4l"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"45.137.70.17"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949342/; classtype:trojan-activity;sid:84812442; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949343)"; flow:established,from_client; content:"GET"; http_method; content:"/i586"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"45.137.70.17"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949343/; classtype:trojan-activity;sid:84812443; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949344)"; flow:established,from_client; content:"GET"; http_method; content:"/mipsel"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"45.137.70.17"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949344/; classtype:trojan-activity;sid:84812444; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949345)"; flow:established,from_client; content:"GET"; http_method; content:"/armv5l"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"45.137.70.17"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949345/; classtype:trojan-activity;sid:84812445; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949346)"; flow:established,from_client; content:"GET"; http_method; content:"/sparc"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"45.137.70.17"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949346/; classtype:trojan-activity;sid:84812446; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949347)"; flow:established,from_client; content:"GET"; http_method; content:"/system1.bat"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"ibidasjohnnraplc.com"; http_host; depth:20; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949347/; classtype:trojan-activity;sid:84812447; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949348)"; flow:established,from_client; content:"GET"; http_method; content:"/d/cbjjtwu7"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"csgroup.host"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949348/; classtype:trojan-activity;sid:84812448; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949333)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/bot.x86_32"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"143.20.154.42"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949333/; classtype:trojan-activity;sid:84812433; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949334)"; flow:established,from_client; content:"GET"; http_method; content:"/iran.mips"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"64.89.160.185"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949334/; classtype:trojan-activity;sid:84812434; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949335)"; flow:established,from_client; content:"GET"; http_method; content:"/iran.i486"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"64.89.160.185"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949335/; classtype:trojan-activity;sid:84812435; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949336)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/arm5"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"217.60.195.142"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949336/; classtype:trojan-activity;sid:84812436; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949337)"; flow:established,from_client; content:"GET"; http_method; content:"/x86"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"45.137.70.17"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949337/; classtype:trojan-activity;sid:84812437; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949331)"; flow:established,from_client; content:"GET"; http_method; content:"/sh"; http_uri; depth:3; isdataat:!1,relative; nocase; content:"217.60.102.5"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949331/; classtype:trojan-activity;sid:84812431; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949332)"; flow:established,from_client; content:"GET"; http_method; content:"/snypetcp.sh"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949332/; classtype:trojan-activity;sid:84812432; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949330)"; flow:established,from_client; content:"GET"; http_method; content:"/jklm68k"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"176.65.139.40"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949330/; classtype:trojan-activity;sid:84812430; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949329)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"39.74.47.172"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949329/; classtype:trojan-activity;sid:84812429; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949328)"; flow:established,from_client; content:"GET"; http_method; content:"/anticheat_update.exe"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"security-analyze.ltd"; http_host; depth:20; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949328/; classtype:trojan-activity;sid:84812428; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949327)"; flow:established,from_client; content:"GET"; http_method; content:"/aisu/aisu.i486"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"64.89.160.185"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949327/; classtype:trojan-activity;sid:84812427; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949326)"; flow:established,from_client; content:"GET"; http_method; content:"/faceit.ps1"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"software.security-analyze.ltd"; http_host; depth:29; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949326/; classtype:trojan-activity;sid:84812426; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949325)"; flow:established,from_client; content:"GET"; http_method; content:"/scl/fi/vxf9abexyh7r7obesid96/bulbulo.zip|3f|rlkey=v5bb8nznht61xj8na9f512r8n|7c|26|7c|st=k231h5lq|7c|26|7c|dl=1"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"www.dropbox.com"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949325/; classtype:trojan-activity;sid:84812425; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949322)"; flow:established,from_client; content:"GET"; http_method; content:"/main_sh4"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"153.56.180.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949322/; classtype:trojan-activity;sid:84812422; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949323)"; flow:established,from_client; content:"GET"; http_method; content:"/main_mpsl"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"153.56.180.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949323/; classtype:trojan-activity;sid:84812423; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949324)"; flow:established,from_client; content:"GET"; http_method; content:"/main_ppc"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"153.56.180.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949324/; classtype:trojan-activity;sid:84812424; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949320)"; flow:established,from_client; content:"GET"; http_method; content:"/main_arm5"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"153.56.180.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949320/; classtype:trojan-activity;sid:84812420; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949321)"; flow:established,from_client; content:"GET"; http_method; content:"/main_m68k"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"153.56.180.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949321/; classtype:trojan-activity;sid:84812421; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949319)"; flow:established,from_client; content:"GET"; http_method; content:"/ppc"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"176.65.139.151"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949319/; classtype:trojan-activity;sid:84812419; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949318)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"38.46.31.127"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949318/; classtype:trojan-activity;sid:84812418; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949317)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"112.248.114.87"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949317/; classtype:trojan-activity;sid:84812417; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949316)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.138.116.13"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949316/; classtype:trojan-activity;sid:84812416; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949315)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"218.16.164.47"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949315/; classtype:trojan-activity;sid:84812415; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949314)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"110.227.209.99"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949314/; classtype:trojan-activity;sid:84812414; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949312)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"170.84.133.234"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949312/; classtype:trojan-activity;sid:84812412; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949313)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"210.208.104.156"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949313/; classtype:trojan-activity;sid:84812413; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949311)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"112.248.81.107"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949311/; classtype:trojan-activity;sid:84812411; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949310)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"219.156.119.249"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949310/; classtype:trojan-activity;sid:84812410; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949309)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.62.215.189"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949309/; classtype:trojan-activity;sid:84812409; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949308)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.124.186.9"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949308/; classtype:trojan-activity;sid:84812408; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949307)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.96.138.239"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949307/; classtype:trojan-activity;sid:84812407; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949306)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.57.246.110"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949306/; classtype:trojan-activity;sid:84812406; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949305)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"171.213.236.137"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949305/; classtype:trojan-activity;sid:84812405; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949304)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"221.202.71.15"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949304/; classtype:trojan-activity;sid:84812404; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949302)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.126.92.31"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949302/; classtype:trojan-activity;sid:84812402; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949303)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"103.172.186.194"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949303/; classtype:trojan-activity;sid:84812403; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949299)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"59.96.138.239"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949299/; classtype:trojan-activity;sid:84812399; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949300)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.50.91.72"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949300/; classtype:trojan-activity;sid:84812400; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949301)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.50.91.72"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949301/; classtype:trojan-activity;sid:84812401; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949298)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.63.8.20"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949298/; classtype:trojan-activity;sid:84812398; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949297)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.189.197.131"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949297/; classtype:trojan-activity;sid:84812397; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949296)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.57.246.110"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949296/; classtype:trojan-activity;sid:84812396; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949295)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"163.142.93.231"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949295/; classtype:trojan-activity;sid:84812395; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949292)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"110.186.230.140"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949292/; classtype:trojan-activity;sid:84812392; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949293)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.224.102.154"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949293/; classtype:trojan-activity;sid:84812393; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949294)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.55.240.176"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949294/; classtype:trojan-activity;sid:84812394; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949289)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"163.142.95.133"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949289/; classtype:trojan-activity;sid:84812389; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949290)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.230.54.151"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949290/; classtype:trojan-activity;sid:84812390; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949291)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.179.97.86"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949291/; classtype:trojan-activity;sid:84812391; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949288)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"158.255.83.235"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949288/; classtype:trojan-activity;sid:84812388; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949287)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.50.202.231"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949287/; classtype:trojan-activity;sid:84812387; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949286)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.4.201.156"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949286/; classtype:trojan-activity;sid:84812386; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949284)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.238.130.61"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949284/; classtype:trojan-activity;sid:84812384; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949285)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"170.84.133.234"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949285/; classtype:trojan-activity;sid:84812385; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949283)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.7.221.183"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949283/; classtype:trojan-activity;sid:84812383; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949282)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.84.212.131"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949282/; classtype:trojan-activity;sid:84812382; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949281)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"180.103.139.206"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949281/; classtype:trojan-activity;sid:84812381; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949279)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.7.221.183"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949279/; classtype:trojan-activity;sid:84812379; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949280)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.40.153.104"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949280/; classtype:trojan-activity;sid:84812380; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949278)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.119.221.187"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949278/; classtype:trojan-activity;sid:84812378; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949277)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"1.61.203.231"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949277/; classtype:trojan-activity;sid:84812377; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949276)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.23.239.109"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949276/; classtype:trojan-activity;sid:84812376; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949275)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.141.133.234"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949275/; classtype:trojan-activity;sid:84812375; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949274)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.193.51.129"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949274/; classtype:trojan-activity;sid:84812374; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949273)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.124.12.142"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949273/; classtype:trojan-activity;sid:84812373; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949272)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.238.130.61"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949272/; classtype:trojan-activity;sid:84812372; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949271)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.121.58.197"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949271/; classtype:trojan-activity;sid:84812371; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949266)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.224.77.32"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949266/; classtype:trojan-activity;sid:84812366; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949267)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.122.199.178"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949267/; classtype:trojan-activity;sid:84812367; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949268)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"105.186.241.211"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949268/; classtype:trojan-activity;sid:84812368; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949269)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"116.139.178.34"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949269/; classtype:trojan-activity;sid:84812369; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949270)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.120.46.147"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949270/; classtype:trojan-activity;sid:84812370; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949265)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.122.199.178"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949265/; classtype:trojan-activity;sid:84812365; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949264)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.230.34.249"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949264/; classtype:trojan-activity;sid:84812364; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949262)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.231.174.164"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949262/; classtype:trojan-activity;sid:84812362; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949263)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.56.96.117"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949263/; classtype:trojan-activity;sid:84812363; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949261)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"101.108.13.178"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949261/; classtype:trojan-activity;sid:84812361; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949260)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.193.51.129"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949260/; classtype:trojan-activity;sid:84812360; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949259)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"119.183.102.216"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949259/; classtype:trojan-activity;sid:84812359; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949257)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.57.245.249"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949257/; classtype:trojan-activity;sid:84812357; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949258)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"171.83.60.127"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949258/; classtype:trojan-activity;sid:84812358; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949256)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.125.21.125"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949256/; classtype:trojan-activity;sid:84812356; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949254)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"116.139.178.34"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949254/; classtype:trojan-activity;sid:84812354; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949255)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.96.138.221"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949255/; classtype:trojan-activity;sid:84812355; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949253)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.239.78.50"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949253/; classtype:trojan-activity;sid:84812353; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949252)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.238.223.97"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_13; reference:url, urlhaus.abuse.ch/url/3949252/; classtype:trojan-activity;sid:84812352; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949251)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.239.78.50"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949251/; classtype:trojan-activity;sid:84812351; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949250)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.52.99.43"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949250/; classtype:trojan-activity;sid:84812350; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949249)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.14.84.27"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949249/; classtype:trojan-activity;sid:84812349; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949248)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"151.234.36.252"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949248/; classtype:trojan-activity;sid:84812348; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949247)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"61.238.223.97"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949247/; classtype:trojan-activity;sid:84812347; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949246)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"70.166.118.40"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949246/; classtype:trojan-activity;sid:84812346; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949245)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.57.20.190"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949245/; classtype:trojan-activity;sid:84812345; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949244)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.56.177.207"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949244/; classtype:trojan-activity;sid:84812344; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949243)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.180.79.16"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949243/; classtype:trojan-activity;sid:84812343; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949242)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"119.180.79.16"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949242/; classtype:trojan-activity;sid:84812342; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949240)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"112.248.141.165"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949240/; classtype:trojan-activity;sid:84812340; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949241)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"112.248.81.107"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949241/; classtype:trojan-activity;sid:84812341; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949239)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"116.139.172.245"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949239/; classtype:trojan-activity;sid:84812339; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949238)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.56.140.178"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949238/; classtype:trojan-activity;sid:84812338; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949237)"; flow:established,from_client; content:"GET"; http_method; content:"/mips"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"31.56.209.86"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949237/; classtype:trojan-activity;sid:84812337; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949235)"; flow:established,from_client; content:"GET"; http_method; content:"/armv7l"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"31.56.209.86"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949235/; classtype:trojan-activity;sid:84812335; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949236)"; flow:established,from_client; content:"GET"; http_method; content:"/powerpc"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"31.56.209.86"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949236/; classtype:trojan-activity;sid:84812336; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949233)"; flow:established,from_client; content:"GET"; http_method; content:"/mips64"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"31.56.209.86"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949233/; classtype:trojan-activity;sid:84812333; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949234)"; flow:established,from_client; content:"GET"; http_method; content:"/aarch64"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"31.56.209.86"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949234/; classtype:trojan-activity;sid:84812334; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949230)"; flow:established,from_client; content:"GET"; http_method; content:"/mipsel"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"31.56.209.86"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949230/; classtype:trojan-activity;sid:84812330; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949231)"; flow:established,from_client; content:"GET"; http_method; content:"/x86_64"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"176.65.139.151"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949231/; classtype:trojan-activity;sid:84812331; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949232)"; flow:established,from_client; content:"GET"; http_method; content:"/arm5"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"176.65.139.151"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949232/; classtype:trojan-activity;sid:84812332; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949229)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.165.80.178"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949229/; classtype:trojan-activity;sid:84812329; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949227)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"103.172.221.97"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949227/; classtype:trojan-activity;sid:84812327; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949228)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.151.222.225"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949228/; classtype:trojan-activity;sid:84812328; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949226)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.5.172.91"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949226/; classtype:trojan-activity;sid:84812326; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949225)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.151.222.225"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949225/; classtype:trojan-activity;sid:84812325; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949224)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"103.172.221.97"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949224/; classtype:trojan-activity;sid:84812324; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949223)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.235.49.252"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949223/; classtype:trojan-activity;sid:84812323; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949220)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"101.51.130.85"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949220/; classtype:trojan-activity;sid:84812320; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949221)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"183.35.50.75"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949221/; classtype:trojan-activity;sid:84812321; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949222)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"221.203.146.12"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949222/; classtype:trojan-activity;sid:84812322; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949219)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"83.233.56.26"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949219/; classtype:trojan-activity;sid:84812319; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949218)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.154.182.123"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949218/; classtype:trojan-activity;sid:84812318; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949217)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.10.69.247"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949217/; classtype:trojan-activity;sid:84812317; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949215)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"187.45.95.254"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949215/; classtype:trojan-activity;sid:84812315; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949216)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.157.18.209"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949216/; classtype:trojan-activity;sid:84812316; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949214)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.7.122.114"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949214/; classtype:trojan-activity;sid:84812314; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949213)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.23.233.72"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949213/; classtype:trojan-activity;sid:84812313; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949212)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"101.51.130.85"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949212/; classtype:trojan-activity;sid:84812312; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949211)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.63.134.244"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949211/; classtype:trojan-activity;sid:84812311; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949209)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.174.99.21"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949209/; classtype:trojan-activity;sid:84812309; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949210)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.173.92.197"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949210/; classtype:trojan-activity;sid:84812310; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949207)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.62.157.255"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949207/; classtype:trojan-activity;sid:84812307; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949208)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.61.17.142"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949208/; classtype:trojan-activity;sid:84812308; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949206)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.180.78.75"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949206/; classtype:trojan-activity;sid:84812306; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949203)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"61.53.132.141"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949203/; classtype:trojan-activity;sid:84812303; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949204)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.53.132.141"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949204/; classtype:trojan-activity;sid:84812304; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949205)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.23.232.219"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949205/; classtype:trojan-activity;sid:84812305; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949201)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.127.125.146"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949201/; classtype:trojan-activity;sid:84812301; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949202)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.120.46.147"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949202/; classtype:trojan-activity;sid:84812302; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949200)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.180.78.75"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949200/; classtype:trojan-activity;sid:84812300; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949199)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"119.183.26.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949199/; classtype:trojan-activity;sid:84812299; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949198)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.53.73.21"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949198/; classtype:trojan-activity;sid:84812298; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949197)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.12.173.255"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949197/; classtype:trojan-activity;sid:84812297; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949196)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.215.110.113"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949196/; classtype:trojan-activity;sid:84812296; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949194)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.139.35.60"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949194/; classtype:trojan-activity;sid:84812294; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949195)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.215.110.113"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949195/; classtype:trojan-activity;sid:84812295; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949193)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.184.122.182"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949193/; classtype:trojan-activity;sid:84812293; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949192)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.25.71.38"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949192/; classtype:trojan-activity;sid:84812292; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949191)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.45.67.122"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949191/; classtype:trojan-activity;sid:84812291; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949190)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.184.122.182"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949190/; classtype:trojan-activity;sid:84812290; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949189)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.97.76.148"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949189/; classtype:trojan-activity;sid:84812289; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949188)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.127.73.23"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949188/; classtype:trojan-activity;sid:84812288; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949187)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.14.39.147"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949187/; classtype:trojan-activity;sid:84812287; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949186)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.45.67.122"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949186/; classtype:trojan-activity;sid:84812286; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949185)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"178.206.171.51"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949185/; classtype:trojan-activity;sid:84812285; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949184)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.137.145.82"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949184/; classtype:trojan-activity;sid:84812284; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949181)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.129.133.185"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949181/; classtype:trojan-activity;sid:84812281; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949182)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.207.229.93"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949182/; classtype:trojan-activity;sid:84812282; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949183)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"39.73.144.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949183/; classtype:trojan-activity;sid:84812283; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949180)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"110.136.10.85"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949180/; classtype:trojan-activity;sid:84812280; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949179)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"114.226.124.233"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949179/; classtype:trojan-activity;sid:84812279; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949178)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.187.30.24"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949178/; classtype:trojan-activity;sid:84812278; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949177)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.124.1.62"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949177/; classtype:trojan-activity;sid:84812277; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949176)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.204.23.50"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949176/; classtype:trojan-activity;sid:84812276; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949175)"; flow:established,from_client; content:"GET"; http_method; content:"/eclipse.x86_64"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"65512.cfd"; http_host; depth:9; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949175/; classtype:trojan-activity;sid:84812275; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949173)"; flow:established,from_client; content:"GET"; http_method; content:"/storage/v1/object/sign/mod-files/krypton-client/kryptonplus.jar|3f|token=eyjrawqioiiynge1zgewni1lyzcxltq3mjytotgxmi02mdg3ymqwowfjztyilcjhbgcioijiuzuxmij9.eyj1cmwioijtb2qtzmlszxmva3j5chrvbi1jbgllbnqvs3j5chrvblbsdxmuamfyiiwic2nvcguioijkb3dubg9hzcisimlhdci6mtc5mtgzmja3ocwizxhwijoxnzkxodmynjc4fq.md_sdqw8dbfjb--yfxcqspgh7goxnx81rzlxz1tiuzc3u88-gv1tv8cxgjl9tbnj63kt3qhlht1hvhuxgn7oma"; http_uri; depth:380; isdataat:!1,relative; nocase; content:"c--617b5f35-a107-4800-9047-a429934c0483-prod.lovable.cloud"; http_host; depth:58; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949173/; classtype:trojan-activity;sid:84812273; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949174)"; flow:established,from_client; content:"GET"; http_method; content:"/storage/v1/object/sign/mod-files/meteor-client/meteor-client-1.21.11-86.jar|3f|token=eyjrawqioiiynge1zgewni1lyzcxltq3mjytotgxmi02mdg3ymqwowfjztyilcjhbgcioijiuzuxmij9.eyj1cmwioijtb2qtzmlszxmvbwv0zw9ylwnsawvudc9tzxrlb3ity2xpzw50lteumjeumtetodyuamfyiiwic2nvcguioijkb3dubg9hzcisimlhdci6mtc5mtgzmtk4nswizxhwijoxnzkxodmyntg1fq.9qijupcpt2zadbuislxmc8q1nfcqx2bmxim9v2z8fz0oeljdy141gdpq0k6p64fk4srqsq7wzgnif82br2kfsg"; http_uri; depth:408; isdataat:!1,relative; nocase; content:"c--617b5f35-a107-4800-9047-a429934c0483-prod.lovable.cloud"; http_host; depth:58; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949174/; classtype:trojan-activity;sid:84812274; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949172)"; flow:established,from_client; content:"GET"; http_method; content:"/storage/v1/object/sign/mod-files/opsec/opsec-1.21.11+v1.1.7.1.jar|3f|token=eyjrawqioiiynge1zgewni1lyzcxltq3mjytotgxmi02mdg3ymqwowfjztyilcjhbgcioijiuzuxmij9.eyj1cmwioijtb2qtzmlszxmvb3bzzwmvb3bzzwmtms4yms4xmst2ms4xljcums5qyxiilcjzy29wzsi6imrvd25sb2fkiiwiawf0ijoxnzkxodmymdqwlcjlehaioje3ote4mzi2ndb9.gmqsayt-q4uke3xo58jjqpxiy3ifduita4_wkp4a9rreylbgciv1woow7wqwpgfeaupthlktelztzplh9jelaa"; http_uri; depth:384; isdataat:!1,relative; nocase; content:"c--617b5f35-a107-4800-9047-a429934c0483-prod.lovable.cloud"; http_host; depth:58; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949172/; classtype:trojan-activity;sid:84812272; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949171)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.113.25.83"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949171/; classtype:trojan-activity;sid:84812271; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949170)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1558538178170855506/1558539628779143208/nova_1.21.11.jar|3f|ex=6ace71a3|7c|26|7c|is=6acd2023|7c|26|7c|hm=c1eae6a12fab251587b9922092a345cce0581cdd37a84db0d101a14000e3d039|7c|26|7c|"; http_uri; depth:192; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949170/; classtype:trojan-activity;sid:84812270; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949168)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"112.198.238.18"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949168/; classtype:trojan-activity;sid:84812268; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949169)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1558537759193305238/1558538966754398325/kryptonclient-1.21.11.jar|3f|ex=6ace7105|7c|26|7c|is=6acd1f85|7c|26|7c|hm=dd1152c5791252c9189fb3c0bdf14b5cdf3f5d726251d16fccaac70247fe4dc5|7c|26|7c|"; http_uri; depth:201; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949169/; classtype:trojan-activity;sid:84812269; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949167)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"109.97.45.66"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949167/; classtype:trojan-activity;sid:84812267; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949166)"; flow:established,from_client; content:"GET"; http_method; content:"/file/img_234455.png"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"23.132.164.72"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949166/; classtype:trojan-activity;sid:84812266; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949165)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"114.226.124.233"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949165/; classtype:trojan-activity;sid:84812265; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949164)"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/text/bhxlvkt/erlodfc/stykqbz/ssecured_stub.ps1"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"new-orleans.pl"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949164/; classtype:trojan-activity;sid:84812264; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949162)"; flow:established,from_client; content:"GET"; http_method; content:"/img_140114.png"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"activegrp.co.za"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949162/; classtype:trojan-activity;sid:84812262; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949163)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1557190077522649129/1558972064323346582/morphv2.jar|3f|ex=6ace0a20|7c|26|7c|is=6accb8a0|7c|26|7c|hm=b7ddca9fb558651eab24a095e1e6e8bce4e98057ad991097631d03b9f0cd511e|7c|26|7c|"; http_uri; depth:187; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949163/; classtype:trojan-activity;sid:84812263; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949161)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1559259585808695467/1559259940613521428/goobacracked.jar|3f|ex=6ace6d7b|7c|26|7c|is=6acd1bfb|7c|26|7c|hm=edfbf483f62c0f39f32dcf1b07fbc48dc88373312fac7e95f4d9b1dfbed2181f|7c|26|7c|"; http_uri; depth:192; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949161/; classtype:trojan-activity;sid:84812261; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949159)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1557190400052166666/1559258245275721880/waterclientdev.jar|3f|ex=6ace6be7|7c|26|7c|is=6acd1a67|7c|26|7c|hm=25d1151c6512a87e0e7826e01c716b961d1766d978bdcab4315ee802f691ddd0|7c|26|7c|"; http_uri; depth:194; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949159/; classtype:trojan-activity;sid:84812259; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949160)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1557189284102934558/1557193833127743529/codeenginecracked.jar|3f|backend=b2|7c|26|7c|ex=6ace2985|7c|26|7c|is=6accd805|7c|26|7c|hm=22000876502c1ff386610d11ceea26b90773413780f73fde3b4e6b2eca173705|7c|26|7c|"; http_uri; depth:217; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949160/; classtype:trojan-activity;sid:84812260; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949158)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1557190619187773582/1559259137131417721/67clientcracked.jar|3f|ex=6ace6cbb|7c|26|7c|is=6acd1b3b|7c|26|7c|hm=b2f1382a187f0a56484f7af8f4a2b8c43c9b38952a985fdb3a0edad0e94ae953|7c|26|7c|"; http_uri; depth:195; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949158/; classtype:trojan-activity;sid:84812258; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949151)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1557189739763994644/1558970084800864267/lemon_debug.jar|3f|ex=6ace0848|7c|26|7c|is=6accb6c8|7c|26|7c|hm=024423b7657f622fb6f5618c2ed59bade00e4edea98a87f31d5adac1947a94fe|7c|26|7c|"; http_uri; depth:191; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949151/; classtype:trojan-activity;sid:84812251; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949152)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1557190559662088223/1559258960614391912/waterclientcracked.jar|3f|ex=6ace6c91|7c|26|7c|is=6acd1b11|7c|26|7c|hm=70e31dd563b633ecfb4d9815dd4628b00e665b137479600f66d083d1fe31cdf3|7c|26|7c|"; http_uri; depth:198; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949152/; classtype:trojan-activity;sid:84812252; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949153)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1557190023886020640/1558971575255040081/speddebugcracked-.jar|3f|ex=6ace09ab|7c|26|7c|is=6accb82b|7c|26|7c|hm=49353d6f1dbb89df797790ad8d8cd7785d961866e606e3eadacc346a7131db92|7c|26|7c|"; http_uri; depth:197; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949153/; classtype:trojan-activity;sid:84812253; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949154)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1557190213120303175/1558972335887880242/mental_debug_cracked.jar|3f|ex=6ace0a61|7c|26|7c|is=6accb8e1|7c|26|7c|hm=887dfe3a41d4602262e7eb21073df9ac6ab2597eb72c7581807376caf82f40c9|7c|26|7c|"; http_uri; depth:200; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949154/; classtype:trojan-activity;sid:84812254; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949155)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1557189597404991528/1558968799099625564/nova_addon.jar|3f|ex=6ace0715|7c|26|7c|is=6accb595|7c|26|7c|hm=4c11b5908976ab897ef243baa03520741a2ec64432b34975fe5e05231676afd7|7c|26|7c|"; http_uri; depth:190; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949155/; classtype:trojan-activity;sid:84812255; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949156)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1557189927907631244/1558971327300243568/larp_debug_v8_2.jar|3f|ex=6ace0970|7c|26|7c|is=6accb7f0|7c|26|7c|hm=9bc4617fdd5c8b3edc755ce6ebcc28a8283c2f67bc470c55f15c0fbe7a1795db|7c|26|7c|"; http_uri; depth:195; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949156/; classtype:trojan-activity;sid:84812256; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949157)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1557188215520370778/1557193185917149204/swyzzyclientcracked.jar|3f|backend=b2|7c|26|7c|ex=6ace28ea|7c|26|7c|is=6accd76a|7c|26|7c|hm=7697dbec32ab3081b1805d70629a69c67e47f177af40d38c2bf2e51483d02be0|7c|26|7c|"; http_uri; depth:219; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949157/; classtype:trojan-activity;sid:84812257; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949150)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.m"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.215.55.107"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949150/; classtype:trojan-activity;sid:84812250; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949149)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.204.23.50"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949149/; classtype:trojan-activity;sid:84812249; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949147)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.190.1.39"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949147/; classtype:trojan-activity;sid:84812247; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949148)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.207.112.61"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949148/; classtype:trojan-activity;sid:84812248; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949145)"; flow:established,from_client; content:"GET"; http_method; content:"/55/besofluck.hta"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"104.223.84.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949145/; classtype:trojan-activity;sid:84812245; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949146)"; flow:established,from_client; content:"GET"; http_method; content:"/1.jpg"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"104.223.84.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949146/; classtype:trojan-activity;sid:84812246; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949144)"; flow:established,from_client; content:"GET"; http_method; content:"/sxpl/dbjdfmd.txt"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"nd.tdpqnf.com"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949144/; classtype:trojan-activity;sid:84812244; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949143)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.127.125.146"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949143/; classtype:trojan-activity;sid:84812243; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949142)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.126.92.31"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949142/; classtype:trojan-activity;sid:84812242; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949141)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"183.129.51.116"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949141/; classtype:trojan-activity;sid:84812241; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949140)"; flow:established,from_client; content:"GET"; http_method; content:"/api/poly-token"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"krause-fahrzeuge.de"; http_host; depth:19; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949140/; classtype:trojan-activity;sid:84812240; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949137)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.m"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"180.191.49.27"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949137/; classtype:trojan-activity;sid:84812237; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949138)"; flow:established,from_client; content:"GET"; http_method; content:"/api/cm-token"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"krause-fahrzeuge.de"; http_host; depth:19; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949138/; classtype:trojan-activity;sid:84812238; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949139)"; flow:established,from_client; content:"GET"; http_method; content:"/tucoyodel"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"146.103.101.229"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949139/; classtype:trojan-activity;sid:84812239; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949136)"; flow:established,from_client; content:"GET"; http_method; content:"/lurowuf"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"146.103.101.229"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949136/; classtype:trojan-activity;sid:84812236; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949135)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"113.238.229.213"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949135/; classtype:trojan-activity;sid:84812235; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949134)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.156.119.249"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949134/; classtype:trojan-activity;sid:84812234; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949133)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.84.215.56"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949133/; classtype:trojan-activity;sid:84812233; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949132)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.134.175.65"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949132/; classtype:trojan-activity;sid:84812232; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949131)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.138.78.42"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949131/; classtype:trojan-activity;sid:84812231; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949130)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"163.142.78.62"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949130/; classtype:trojan-activity;sid:84812230; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949129)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"105.186.118.157"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949129/; classtype:trojan-activity;sid:84812229; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949128)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"117.235.146.45"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949128/; classtype:trojan-activity;sid:84812228; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949127)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"117.26.227.112"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949127/; classtype:trojan-activity;sid:84812227; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949126)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.241.234.107"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949126/; classtype:trojan-activity;sid:84812226; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949125)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.106.96.203"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949125/; classtype:trojan-activity;sid:84812225; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949124)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.5.16.160"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949124/; classtype:trojan-activity;sid:84812224; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949123)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.161.90.221"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949123/; classtype:trojan-activity;sid:84812223; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949121)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.14.84.27"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949121/; classtype:trojan-activity;sid:84812221; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949122)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.170.101.120"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949122/; classtype:trojan-activity;sid:84812222; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949120)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.141.81.197"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949120/; classtype:trojan-activity;sid:84812220; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949119)"; flow:established,from_client; content:"GET"; http_method; content:"/files/xeno-v1.3.60.exe"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"31.76.101.174"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949119/; classtype:trojan-activity;sid:84812219; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949117)"; flow:established,from_client; content:"GET"; http_method; content:"/files/app.exe"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"31.76.101.174"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949117/; classtype:trojan-activity;sid:84812217; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949118)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/x86"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"176.65.139.76"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949118/; classtype:trojan-activity;sid:84812218; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949116)"; flow:established,from_client; content:"GET"; http_method; content:"/mips"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"176.65.139.151"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949116/; classtype:trojan-activity;sid:84812216; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949113)"; flow:established,from_client; content:"GET"; http_method; content:"/arm7"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"176.65.139.151"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949113/; classtype:trojan-activity;sid:84812213; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949114)"; flow:established,from_client; content:"GET"; http_method; content:"/m68k"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"176.65.139.151"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949114/; classtype:trojan-activity;sid:84812214; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949115)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/ppc"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"176.65.139.76"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949115/; classtype:trojan-activity;sid:84812215; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949110)"; flow:established,from_client; content:"GET"; http_method; content:"/arm6"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"176.65.139.151"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949110/; classtype:trojan-activity;sid:84812210; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949111)"; flow:established,from_client; content:"GET"; http_method; content:"/mips64"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"176.65.139.151"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949111/; classtype:trojan-activity;sid:84812211; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949112)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/spc"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"176.65.139.76"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949112/; classtype:trojan-activity;sid:84812212; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949109)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"120.28.135.4"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949109/; classtype:trojan-activity;sid:84812209; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949106)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.227.36.195"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949106/; classtype:trojan-activity;sid:84812206; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949107)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.84.215.161"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949107/; classtype:trojan-activity;sid:84812207; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949108)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.178.31.252"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949108/; classtype:trojan-activity;sid:84812208; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949105)"; flow:established,from_client; content:"GET"; http_method; content:"/r"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"cocuktekstil.com"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949105/; classtype:trojan-activity;sid:84812205; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949104)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.50.227.210"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949104/; classtype:trojan-activity;sid:84812204; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949103)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"122.235.142.205"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949103/; classtype:trojan-activity;sid:84812203; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949101)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.186.241.211"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949101/; classtype:trojan-activity;sid:84812201; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949102)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.84.212.9"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949102/; classtype:trojan-activity;sid:84812202; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949100)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"183.129.51.116"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949100/; classtype:trojan-activity;sid:84812200; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949099)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"117.63.188.228"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949099/; classtype:trojan-activity;sid:84812199; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949098)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.48.149.27"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949098/; classtype:trojan-activity;sid:84812198; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949096)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.49.29.192"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949096/; classtype:trojan-activity;sid:84812196; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949097)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"1.61.203.231"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949097/; classtype:trojan-activity;sid:84812197; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949095)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.12.8.15"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949095/; classtype:trojan-activity;sid:84812195; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949094)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"213.5.19.99"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949094/; classtype:trojan-activity;sid:84812194; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949093)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"117.63.188.228"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949093/; classtype:trojan-activity;sid:84812193; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949092)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.57.82.253"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949092/; classtype:trojan-activity;sid:84812192; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949091)"; flow:established,from_client; content:"GET"; http_method; content:"/files/5279938618/ha0vowg.exe"; http_uri; depth:29; isdataat:!1,relative; nocase; content:"62.60.226.140"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949091/; classtype:trojan-activity;sid:84812191; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949090)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.53.12.33"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949090/; classtype:trojan-activity;sid:84812190; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949088)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"59.96.136.247"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949088/; classtype:trojan-activity;sid:84812188; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949089)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.96.136.247"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949089/; classtype:trojan-activity;sid:84812189; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949086)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"103.152.100.5"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949086/; classtype:trojan-activity;sid:84812186; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949087)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.224.88.202"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949087/; classtype:trojan-activity;sid:84812187; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949085)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"117.223.140.115"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949085/; classtype:trojan-activity;sid:84812185; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949084)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.224.120.224"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949084/; classtype:trojan-activity;sid:84812184; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949083)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.53.12.33"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949083/; classtype:trojan-activity;sid:84812183; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949081)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.239.224.109"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949081/; classtype:trojan-activity;sid:84812181; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949082)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.233.144.133"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949082/; classtype:trojan-activity;sid:84812182; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949080)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"117.223.140.115"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949080/; classtype:trojan-activity;sid:84812180; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949079)"; flow:established,from_client; content:"GET"; http_method; content:"/generalrequirementsv2.aspx_files/saved_resource.html"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"tms.hazentransferllc.com"; http_host; depth:24; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949079/; classtype:trojan-activity;sid:84812179; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949078)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"186.149.204.12"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949078/; classtype:trojan-activity;sid:84812178; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949077)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"186.149.204.12"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949077/; classtype:trojan-activity;sid:84812177; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949075)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.49.29.192"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949075/; classtype:trojan-activity;sid:84812175; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949076)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.54.182.188"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949076/; classtype:trojan-activity;sid:84812176; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949073)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"24.54.74.184"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949073/; classtype:trojan-activity;sid:84812173; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949074)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"210.208.104.156"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949074/; classtype:trojan-activity;sid:84812174; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949072)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"103.152.100.5"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949072/; classtype:trojan-activity;sid:84812172; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949070)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"61.53.140.53"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949070/; classtype:trojan-activity;sid:84812170; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949071)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.50.48.150"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949071/; classtype:trojan-activity;sid:84812171; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949069)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"210.208.110.4"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949069/; classtype:trojan-activity;sid:84812169; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949068)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.57.82.253"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949068/; classtype:trojan-activity;sid:84812168; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949066)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"96.246.230.97"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949066/; classtype:trojan-activity;sid:84812166; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949067)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"36.89.252.178"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949067/; classtype:trojan-activity;sid:84812167; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949065)"; flow:established,from_client; content:"GET"; http_method; content:"/payload.b64"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"38.60.179.31"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949065/; classtype:trojan-activity;sid:84812165; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949061)"; flow:established,from_client; content:"GET"; http_method; content:"/c2.py"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"38.60.179.31"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949061/; classtype:trojan-activity;sid:84812161; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949062)"; flow:established,from_client; content:"GET"; http_method; content:"/gen.rc"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"38.60.179.31"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949062/; classtype:trojan-activity;sid:84812162; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949063)"; flow:established,from_client; content:"GET"; http_method; content:"/oc_listen.py"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"38.60.179.31"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949063/; classtype:trojan-activity;sid:84812163; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949064)"; flow:established,from_client; content:"GET"; http_method; content:"/gen.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"38.60.179.31"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949064/; classtype:trojan-activity;sid:84812164; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949060)"; flow:established,from_client; content:"GET"; http_method; content:"/setup.sh"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"217.60.242.38"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949060/; classtype:trojan-activity;sid:84812160; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949059)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.132.181.11"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949059/; classtype:trojan-activity;sid:84812159; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949058)"; flow:established,from_client; content:"GET"; http_method; content:"/payload.bin"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"38.60.179.31"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949058/; classtype:trojan-activity;sid:84812158; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949057)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.52.188.61"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949057/; classtype:trojan-activity;sid:84812157; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949056)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.227.36.195"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949056/; classtype:trojan-activity;sid:84812156; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949055)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.11.2.73"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949055/; classtype:trojan-activity;sid:84812155; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949054)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.52.199.227"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949054/; classtype:trojan-activity;sid:84812154; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949053)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"61.53.150.241"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949053/; classtype:trojan-activity;sid:84812153; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949052)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.189.132.118"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949052/; classtype:trojan-activity;sid:84812152; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949051)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.246.23.235"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949051/; classtype:trojan-activity;sid:84812151; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949050)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.11.2.73"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949050/; classtype:trojan-activity;sid:84812150; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949049)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"196.189.132.118"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949049/; classtype:trojan-activity;sid:84812149; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949048)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"202.166.165.60"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949048/; classtype:trojan-activity;sid:84812148; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949046)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.155.203.127"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949046/; classtype:trojan-activity;sid:84812146; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949047)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"210.208.110.4"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949047/; classtype:trojan-activity;sid:84812147; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949044)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"202.110.28.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949044/; classtype:trojan-activity;sid:84812144; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949045)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"210.208.110.21"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949045/; classtype:trojan-activity;sid:84812145; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949043)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.220.121.135"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949043/; classtype:trojan-activity;sid:84812143; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949042)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"210.208.111.26"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949042/; classtype:trojan-activity;sid:84812142; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949041)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.199.194.186"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949041/; classtype:trojan-activity;sid:84812141; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949040)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.44.145.53"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949040/; classtype:trojan-activity;sid:84812140; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949039)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.174.40.98"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949039/; classtype:trojan-activity;sid:84812139; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949038)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.5.125.158"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949038/; classtype:trojan-activity;sid:84812138; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949037)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.177.100.35"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949037/; classtype:trojan-activity;sid:84812137; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949036)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.211.46.158"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949036/; classtype:trojan-activity;sid:84812136; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949032)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.23.238.24"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949032/; classtype:trojan-activity;sid:84812132; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949033)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"221.202.215.132"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949033/; classtype:trojan-activity;sid:84812133; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949034)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.58.90.151"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949034/; classtype:trojan-activity;sid:84812134; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949035)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.141.73.146"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949035/; classtype:trojan-activity;sid:84812135; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949031)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.5.125.158"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949031/; classtype:trojan-activity;sid:84812131; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949030)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.230.218.97"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949030/; classtype:trojan-activity;sid:84812130; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949029)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"210.208.110.42"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949029/; classtype:trojan-activity;sid:84812129; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949026)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.62.157.255"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949026/; classtype:trojan-activity;sid:84812126; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949027)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"210.97.100.192"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949027/; classtype:trojan-activity;sid:84812127; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949028)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"59.96.142.225"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949028/; classtype:trojan-activity;sid:84812128; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949025)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"210.208.116.107"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949025/; classtype:trojan-activity;sid:84812125; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949019)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"196.189.68.239"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949019/; classtype:trojan-activity;sid:84812119; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949020)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"202.166.165.60"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949020/; classtype:trojan-activity;sid:84812120; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949021)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.189.68.239"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949021/; classtype:trojan-activity;sid:84812121; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949022)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"190.109.227.192"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949022/; classtype:trojan-activity;sid:84812122; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949023)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.228.218.9"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949023/; classtype:trojan-activity;sid:84812123; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949024)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"210.97.100.192"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949024/; classtype:trojan-activity;sid:84812124; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949018)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"185.141.233.178"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949018/; classtype:trojan-activity;sid:84812118; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949017)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.197.62.42"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949017/; classtype:trojan-activity;sid:84812117; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949016)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.233.144.133"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949016/; classtype:trojan-activity;sid:84812116; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949015)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1543991927924457544/1559131740604465222/bundle_5.zip|3f|ex=6acdf616|7c|26|7c|is=6acca496|7c|26|7c|hm=b7bfd42a898f86d57d1892a97e2f65b4798ac00262877a86839f26fe4d32c22d|7c|26|7c|"; http_uri; depth:188; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949015/; classtype:trojan-activity;sid:84812115; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949014)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"210.208.111.220"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949014/; classtype:trojan-activity;sid:84812114; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949012)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"220.198.113.126"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949012/; classtype:trojan-activity;sid:84812112; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949013)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"210.208.110.221"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949013/; classtype:trojan-activity;sid:84812113; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949011)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"210.208.110.172"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949011/; classtype:trojan-activity;sid:84812111; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949010)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"185.141.233.178"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949010/; classtype:trojan-activity;sid:84812110; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949005)"; flow:established,from_client; content:"GET"; http_method; content:"/arm5"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"94.154.43.137"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949005/; classtype:trojan-activity;sid:84812105; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949006)"; flow:established,from_client; content:"GET"; http_method; content:"/mipsel"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"94.154.43.137"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949006/; classtype:trojan-activity;sid:84812106; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949007)"; flow:established,from_client; content:"GET"; http_method; content:"/arm7"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"94.154.43.137"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949007/; classtype:trojan-activity;sid:84812107; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949008)"; flow:established,from_client; content:"GET"; http_method; content:"/mips64"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"94.154.43.137"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949008/; classtype:trojan-activity;sid:84812108; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949009)"; flow:established,from_client; content:"GET"; http_method; content:"/m68k"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"94.154.43.137"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949009/; classtype:trojan-activity;sid:84812109; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949004)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/m68k"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"176.65.139.76"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949004/; classtype:trojan-activity;sid:84812104; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949002)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sh4"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"176.65.139.76"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949002/; classtype:trojan-activity;sid:84812102; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949003)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/mips"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"176.65.139.76"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949003/; classtype:trojan-activity;sid:84812103; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949001)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/x86_64"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"176.65.139.76"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949001/; classtype:trojan-activity;sid:84812101; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948994)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/arm"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"176.65.139.76"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948994/; classtype:trojan-activity;sid:84812094; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948995)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/arm7"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"176.65.139.76"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948995/; classtype:trojan-activity;sid:84812095; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948996)"; flow:established,from_client; content:"GET"; http_method; content:"/arm6"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"94.154.43.137"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948996/; classtype:trojan-activity;sid:84812096; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948997)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/arm5"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"176.65.139.76"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948997/; classtype:trojan-activity;sid:84812097; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948998)"; flow:established,from_client; content:"GET"; http_method; content:"/ppc"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"94.154.43.137"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948998/; classtype:trojan-activity;sid:84812098; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948999)"; flow:established,from_client; content:"GET"; http_method; content:"/x86_64"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"94.154.43.137"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948999/; classtype:trojan-activity;sid:84812099; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3949000)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/arm6"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"176.65.139.76"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3949000/; classtype:trojan-activity;sid:84812100; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948993)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.202.107.229"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948993/; classtype:trojan-activity;sid:84812093; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948992)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.52.216.45"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948992/; classtype:trojan-activity;sid:84812092; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948989)"; flow:established,from_client; content:"GET"; http_method; content:"/files-129312398/files/file_eba22b93c4d912e0.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"91.92.242.236"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948989/; classtype:trojan-activity;sid:84812089; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948990)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"61.52.110.184"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948990/; classtype:trojan-activity;sid:84812090; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948991)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.52.110.184"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948991/; classtype:trojan-activity;sid:84812091; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948988)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.160.112.104"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948988/; classtype:trojan-activity;sid:84812088; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948987)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.139.67.114"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948987/; classtype:trojan-activity;sid:84812087; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948986)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.53.88.238"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948986/; classtype:trojan-activity;sid:84812086; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948985)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.202.215.132"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948985/; classtype:trojan-activity;sid:84812085; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948984)"; flow:established,from_client; content:"GET"; http_method; content:"/files-129312398/files/file_c1972017151d3297.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"91.92.242.236"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948984/; classtype:trojan-activity;sid:84812084; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948983)"; flow:established,from_client; content:"GET"; http_method; content:"/abex2/dicfips.txt"; http_uri; depth:18; isdataat:!1,relative; nocase; content:"www.tmcksa.com"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948983/; classtype:trojan-activity;sid:84812083; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948981)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.142.204.162"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948981/; classtype:trojan-activity;sid:84812081; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948982)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.119.197.98"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948982/; classtype:trojan-activity;sid:84812082; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948979)"; flow:established,from_client; content:"GET"; http_method; content:"/openworddocument.ps1"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"vejnqoajk1soxy1x.public.blob.vercel-storage.com"; http_host; depth:47; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948979/; classtype:trojan-activity;sid:84812079; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948980)"; flow:established,from_client; content:"GET"; http_method; content:"/files-129312398/files/file_f44993b0dff159ea.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"91.92.242.236"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948980/; classtype:trojan-activity;sid:84812080; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948978)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"124.129.119.149"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948978/; classtype:trojan-activity;sid:84812078; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948977)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"124.129.119.149"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948977/; classtype:trojan-activity;sid:84812077; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948975)"; flow:established,from_client; content:"GET"; http_method; content:"/bobbi/secured_stub.ps1"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"sedrezltd.best"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948975/; classtype:trojan-activity;sid:84812075; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948976)"; flow:established,from_client; content:"GET"; http_method; content:"/vi1xwsm/trbhoun/wzyergu/cc/secured_stub1.ps1"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"sqpengg.com"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948976/; classtype:trojan-activity;sid:84812076; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948974)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.40.158.82"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948974/; classtype:trojan-activity;sid:84812074; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948973)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.173.109.117"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948973/; classtype:trojan-activity;sid:84812073; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948972)"; flow:established,from_client; content:"GET"; http_method; content:"/ceo/secured_stub.ps1"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"sedrezltd.best"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948972/; classtype:trojan-activity;sid:84812072; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948971)"; flow:established,from_client; content:"GET"; http_method; content:"/file/img_151712.png"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"23.132.164.72"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948971/; classtype:trojan-activity;sid:84812071; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948970)"; flow:established,from_client; content:"GET"; http_method; content:"/img_160619.png"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"activegrp.co.za"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948970/; classtype:trojan-activity;sid:84812070; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948969)"; flow:established,from_client; content:"GET"; http_method; content:"/yoixlfdae"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"rough-truth-e072.publicftpresend.workers.dev"; http_host; depth:44; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948969/; classtype:trojan-activity;sid:84812069; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948968)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.117.155.139"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948968/; classtype:trojan-activity;sid:84812068; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948967)"; flow:established,from_client; content:"GET"; http_method; content:"/img_190228.png"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"samul.elblag.pl"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948967/; classtype:trojan-activity;sid:84812067; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948966)"; flow:established,from_client; content:"GET"; http_method; content:"/xppimg_040306.png"; http_uri; depth:18; isdataat:!1,relative; nocase; content:"147.45.116.134"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948966/; classtype:trojan-activity;sid:84812066; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948965)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.10.203.32"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948965/; classtype:trojan-activity;sid:84812065; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948964)"; flow:established,from_client; content:"GET"; http_method; content:"/img_063332.png"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"summitcapitalpatners.ink"; http_host; depth:24; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948964/; classtype:trojan-activity;sid:84812064; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948963)"; flow:established,from_client; content:"GET"; http_method; content:"/lllahvot"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"rough-truth-e072.publicftpresend.workers.dev"; http_host; depth:44; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948963/; classtype:trojan-activity;sid:84812063; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948962)"; flow:established,from_client; content:"GET"; http_method; content:"/huumsmsk/secured_stub.ps1"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"twejamaica.org"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948962/; classtype:trojan-activity;sid:84812062; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948961)"; flow:established,from_client; content:"GET"; http_method; content:"/components/com_media/fkqabmp/ntxqre1/edfwcgi/mmmsecured_stub.ps1"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"www.beinke-aufzuege.de"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948961/; classtype:trojan-activity;sid:84812061; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948960)"; flow:established,from_client; content:"GET"; http_method; content:"/.well-known/pxup.exe"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"livinginpurpose.co.za"; http_host; depth:21; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948960/; classtype:trojan-activity;sid:84812060; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948959)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"112.247.84.180"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948959/; classtype:trojan-activity;sid:84812059; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948957)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"111.179.174.242"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948957/; classtype:trojan-activity;sid:84812057; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948958)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.189.205.161"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948958/; classtype:trojan-activity;sid:84812058; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948953)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"39.88.129.230"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948953/; classtype:trojan-activity;sid:84812053; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948954)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.206.196.202"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948954/; classtype:trojan-activity;sid:84812054; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948955)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"110.136.10.85"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948955/; classtype:trojan-activity;sid:84812055; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948956)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"39.74.101.68"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948956/; classtype:trojan-activity;sid:84812056; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948952)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.173.109.117"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948952/; classtype:trojan-activity;sid:84812052; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948951)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.62.178.98"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948951/; classtype:trojan-activity;sid:84812051; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948950)"; flow:established,from_client; content:"GET"; http_method; content:"/system.exe"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"ibidasjohnnraplc.com"; http_host; depth:20; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948950/; classtype:trojan-activity;sid:84812050; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948949)"; flow:established,from_client; content:"GET"; http_method; content:"/b/kal64"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"31.56.209.73"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948949/; classtype:trojan-activity;sid:84812049; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948947)"; flow:established,from_client; content:"GET"; http_method; content:"/x86_64"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"31.56.209.86"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948947/; classtype:trojan-activity;sid:84812047; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948948)"; flow:established,from_client; content:"GET"; http_method; content:"/b/amd64"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"31.56.209.73"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948948/; classtype:trojan-activity;sid:84812048; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948946)"; flow:established,from_client; content:"GET"; http_method; content:"/b/kswpad"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"31.56.209.73"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948946/; classtype:trojan-activity;sid:84812046; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948945)"; flow:established,from_client; content:"GET"; http_method; content:"/st_x86_64"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"31.56.209.86"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948945/; classtype:trojan-activity;sid:84812045; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948944)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.55.12.91"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948944/; classtype:trojan-activity;sid:84812044; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948943)"; flow:established,from_client; content:"GET"; http_method; content:"/curl/42403afd2906a8f3062e3ddb19b28572d88db9ae74b147319383bd280c6bec0a"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"internetlouisiana.com"; http_host; depth:21; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948943/; classtype:trojan-activity;sid:84812043; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948942)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"41.216.227.122"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948942/; classtype:trojan-activity;sid:84812042; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948940)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"103.140.87.105"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948940/; classtype:trojan-activity;sid:84812040; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948941)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"39.88.129.230"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948941/; classtype:trojan-activity;sid:84812041; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948939)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.153.38.114"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948939/; classtype:trojan-activity;sid:84812039; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948938)"; flow:established,from_client; content:"GET"; http_method; content:"/uc|3f|export=download|7c|26|7c|id=1baluscpnzcemy4rl5maj3ynfyxkrsm2l"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"drive.google.com"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948938/; classtype:trojan-activity;sid:84812038; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948935)"; flow:established,from_client; content:"GET"; http_method; content:"/uc|3f|export=download|7c|26|7c|id=1l7z_xcvopuufuttxirsucuukwe-rnwmw"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"drive.google.com"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948935/; classtype:trojan-activity;sid:84812035; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948936)"; flow:established,from_client; content:"GET"; http_method; content:"/manager/equiradial.xsn"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"briannacorporation.com"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948936/; classtype:trojan-activity;sid:84812036; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948937)"; flow:established,from_client; content:"GET"; http_method; content:"/manager/mpczsniylypafar30.bin"; http_uri; depth:30; isdataat:!1,relative; nocase; content:"briannacorporation.com"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948937/; classtype:trojan-activity;sid:84812037; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948934)"; flow:established,from_client; content:"GET"; http_method; content:"/mipsel"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"109.123.243.121"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948934/; classtype:trojan-activity;sid:84812034; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948933)"; flow:established,from_client; content:"GET"; http_method; content:"/x86_64"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"109.123.243.121"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948933/; classtype:trojan-activity;sid:84812033; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948932)"; flow:established,from_client; content:"GET"; http_method; content:"/armv6l"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"109.123.243.121"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948932/; classtype:trojan-activity;sid:84812032; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948931)"; flow:established,from_client; content:"GET"; http_method; content:"/armv7l"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"109.123.243.121"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948931/; classtype:trojan-activity;sid:84812031; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948930)"; flow:established,from_client; content:"GET"; http_method; content:"/armv5l"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"109.123.243.121"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948930/; classtype:trojan-activity;sid:84812030; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948929)"; flow:established,from_client; content:"GET"; http_method; content:"/ppc64"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"109.123.243.121"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948929/; classtype:trojan-activity;sid:84812029; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948928)"; flow:established,from_client; content:"GET"; http_method; content:"/mips"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"109.123.243.121"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948928/; classtype:trojan-activity;sid:84812028; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948927)"; flow:established,from_client; content:"GET"; http_method; content:"/i686"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"109.123.243.121"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948927/; classtype:trojan-activity;sid:84812027; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948913)"; flow:established,from_client; content:"GET"; http_method; content:"/snype.powerpc"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948913/; classtype:trojan-activity;sid:84812013; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948914)"; flow:established,from_client; content:"GET"; http_method; content:"/snype.mipsel"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948914/; classtype:trojan-activity;sid:84812014; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948915)"; flow:established,from_client; content:"GET"; http_method; content:"/snype.sh4"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948915/; classtype:trojan-activity;sid:84812015; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948916)"; flow:established,from_client; content:"GET"; http_method; content:"/snype.arm4"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948916/; classtype:trojan-activity;sid:84812016; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948917)"; flow:established,from_client; content:"GET"; http_method; content:"/snype.arm6"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948917/; classtype:trojan-activity;sid:84812017; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948918)"; flow:established,from_client; content:"GET"; http_method; content:"/snype.armv6l"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948918/; classtype:trojan-activity;sid:84812018; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948919)"; flow:established,from_client; content:"GET"; http_method; content:"/snype.m68k"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948919/; classtype:trojan-activity;sid:84812019; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948920)"; flow:established,from_client; content:"GET"; http_method; content:"/snype.i686"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948920/; classtype:trojan-activity;sid:84812020; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948921)"; flow:established,from_client; content:"GET"; http_method; content:"/snype.armv7l"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948921/; classtype:trojan-activity;sid:84812021; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948922)"; flow:established,from_client; content:"GET"; http_method; content:"/snype.sparc"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948922/; classtype:trojan-activity;sid:84812022; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948923)"; flow:established,from_client; content:"GET"; http_method; content:"/snype.armv4l"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948923/; classtype:trojan-activity;sid:84812023; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948924)"; flow:established,from_client; content:"GET"; http_method; content:"/snype.arm5"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948924/; classtype:trojan-activity;sid:84812024; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948925)"; flow:established,from_client; content:"GET"; http_method; content:"/snype.i586"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948925/; classtype:trojan-activity;sid:84812025; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948926)"; flow:established,from_client; content:"GET"; http_method; content:"/snype.armv5l"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948926/; classtype:trojan-activity;sid:84812026; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948912)"; flow:established,from_client; content:"GET"; http_method; content:"/snype.x86_64"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948912/; classtype:trojan-activity;sid:84812012; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948911)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/hilix.arm7"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"45.153.34.108"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948911/; classtype:trojan-activity;sid:84812011; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948910)"; flow:established,from_client; content:"GET"; http_method; content:"/r"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"threejrev.com"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948910/; classtype:trojan-activity;sid:84812010; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948905)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/hilix.m68k"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"45.153.34.108"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948905/; classtype:trojan-activity;sid:84812005; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948906)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/hilix.arm4"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"45.153.34.108"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948906/; classtype:trojan-activity;sid:84812006; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948907)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/hilix.sh4"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"45.153.34.108"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948907/; classtype:trojan-activity;sid:84812007; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948908)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/hilix.ppc"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"45.153.34.108"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948908/; classtype:trojan-activity;sid:84812008; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948909)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/hilix.arm6"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"45.153.34.108"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948909/; classtype:trojan-activity;sid:84812009; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948904)"; flow:established,from_client; content:"GET"; http_method; content:"/g.php"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"threejrev.com"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948904/; classtype:trojan-activity;sid:84812004; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948903)"; flow:established,from_client; content:"GET"; http_method; content:"/snype.ppc"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948903/; classtype:trojan-activity;sid:84812003; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948898)"; flow:established,from_client; content:"GET"; http_method; content:"/snype.mpsl"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948898/; classtype:trojan-activity;sid:84811998; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948899)"; flow:established,from_client; content:"GET"; http_method; content:"/hb_arm"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"138.124.59.179"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948899/; classtype:trojan-activity;sid:84811999; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948900)"; flow:established,from_client; content:"GET"; http_method; content:"/hb_x86_64"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"138.124.59.179"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948900/; classtype:trojan-activity;sid:84812000; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948901)"; flow:established,from_client; content:"GET"; http_method; content:"/hb_x86"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"138.124.59.179"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948901/; classtype:trojan-activity;sid:84812001; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948902)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1558949934496219279/1558950293205418097/bundle.zip|3f|ex=6acd4d19|7c|26|7c|is=6acbfb99|7c|26|7c|hm=42ce4727da2ac86a08e5ed52faa83ac9be63272c713455d3b5d65592b343ee3d|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948902/; classtype:trojan-activity;sid:84812002; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948895)"; flow:established,from_client; content:"GET"; http_method; content:"/snype.sh"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948895/; classtype:trojan-activity;sid:84811995; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948896)"; flow:established,from_client; content:"GET"; http_method; content:"/snype.x86"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948896/; classtype:trojan-activity;sid:84811996; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948897)"; flow:established,from_client; content:"GET"; http_method; content:"/snype.mips"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948897/; classtype:trojan-activity;sid:84811997; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948894)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.36.243.82"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948894/; classtype:trojan-activity;sid:84811994; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948893)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1527080045678694581/1558893049310875648/ryo.exe|3f|ex=6acd17c9|7c|26|7c|is=6acbc649|7c|26|7c|hm=121d60f61b73516ee09ee4b8393c52fc4881d8a10cd231e17480a11644b94bfa|7c|26|7c|"; http_uri; depth:183; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948893/; classtype:trojan-activity;sid:84811993; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948892)"; flow:established,from_client; content:"GET"; http_method; content:"/zips/e8bb3088f6c55fa6.zip"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"ns.devmicro7.workers.dev"; http_host; depth:24; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948892/; classtype:trojan-activity;sid:84811992; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948889)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.m"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"105.224.11.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948889/; classtype:trojan-activity;sid:84811989; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948890)"; flow:established,from_client; content:"GET"; http_method; content:"/zrsvn1k9w"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"locservice.short.gy"; http_host; depth:19; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948890/; classtype:trojan-activity;sid:84811990; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948891)"; flow:established,from_client; content:"GET"; http_method; content:"/pidor.ps1"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"wall.casajuanchos.com"; http_host; depth:21; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948891/; classtype:trojan-activity;sid:84811991; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948888)"; flow:established,from_client; content:"GET"; http_method; content:"/public/a3a74085-0717-412c-b903-000237b099fe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"api.jsonsilo.com"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948888/; classtype:trojan-activity;sid:84811988; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948886)"; flow:established,from_client; content:"GET"; http_method; content:"/server/v2"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"db-connectors.vercel.app"; http_host; depth:24; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948886/; classtype:trojan-activity;sid:84811986; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948887)"; flow:established,from_client; content:"GET"; http_method; content:"/1460d20e7505bb18"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"rs74ed.s.gy"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948887/; classtype:trojan-activity;sid:84811987; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948873)"; flow:established,from_client; content:"GET"; http_method; content:"/config.js"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"4b5ad122.jsdelivrnetnpm.pages.dev"; http_host; depth:33; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948873/; classtype:trojan-activity;sid:84811973; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948874)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/hilix.mips"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"45.153.34.108"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948874/; classtype:trojan-activity;sid:84811974; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948875)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/hilix.x86"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"45.153.34.108"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948875/; classtype:trojan-activity;sid:84811975; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948876)"; flow:established,from_client; content:"GET"; http_method; content:"/server/v2"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"db-connectify.vercel.app"; http_host; depth:24; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948876/; classtype:trojan-activity;sid:84811976; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948877)"; flow:established,from_client; content:"GET"; http_method; content:"/app/3af981719677/fileinspectorx.msi"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"151.240.151.223"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948877/; classtype:trojan-activity;sid:84811977; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948878)"; flow:established,from_client; content:"GET"; http_method; content:"/"; http_uri; depth:1; isdataat:!1,relative; nocase; content:"212.193.3.61"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948878/; classtype:trojan-activity;sid:84811978; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948879)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/hilix.arm5"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"45.153.34.108"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948879/; classtype:trojan-activity;sid:84811979; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948880)"; flow:established,from_client; content:"GET"; http_method; content:"/rainimips"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"2.27.14.196"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948880/; classtype:trojan-activity;sid:84811980; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948881)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/hilix.mpsl"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"45.153.34.108"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948881/; classtype:trojan-activity;sid:84811981; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948882)"; flow:established,from_client; content:"GET"; http_method; content:"/update.sh"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"s1w21.comen.store"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948882/; classtype:trojan-activity;sid:84811982; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948883)"; flow:established,from_client; content:"GET"; http_method; content:"/8f3d559759e67132"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"configprovider.short.gy"; http_host; depth:23; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948883/; classtype:trojan-activity;sid:84811983; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948884)"; flow:established,from_client; content:"GET"; http_method; content:"/40e32d283a9d97e59252/a"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"api.npoint.io"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948884/; classtype:trojan-activity;sid:84811984; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948872)"; flow:established,from_client; content:"GET"; http_method; content:"/api/service/f43729dbad1c5a00380e710e537ffd6f"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"45.61.129.179"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948872/; classtype:trojan-activity;sid:84811972; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948869)"; flow:established,from_client; content:"GET"; http_method; content:"/zrsvn1k9m"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"locservice.short.gy"; http_host; depth:19; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948869/; classtype:trojan-activity;sid:84811969; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948870)"; flow:established,from_client; content:"GET"; http_method; content:"/zrsvn1k9l"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"locservice.short.gy"; http_host; depth:19; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948870/; classtype:trojan-activity;sid:84811970; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948871)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.113.225.172"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948871/; classtype:trojan-activity;sid:84811971; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948868)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1557407042342490153/1558930025087111208/bundle.zip|3f|ex=6acd3a39|7c|26|7c|is=6acbe8b9|7c|26|7c|hm=d87dee57337cca055561b91abdf79267971c3acb3f79af64618d3b03225810d9|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948868/; classtype:trojan-activity;sid:84811968; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948867)"; flow:established,from_client; content:"GET"; http_method; content:"/tad"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"26usdm.oss-cn-beijing.aliyuncs.com"; http_host; depth:34; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948867/; classtype:trojan-activity;sid:84811967; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948864)"; flow:established,from_client; content:"GET"; http_method; content:"/tad"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"unby6r.oss-cn-beijing.aliyuncs.com"; http_host; depth:34; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948864/; classtype:trojan-activity;sid:84811964; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948865)"; flow:established,from_client; content:"GET"; http_method; content:"/nazyrea3bs9ilbd"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"locservice.short.gy"; http_host; depth:19; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948865/; classtype:trojan-activity;sid:84811965; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948866)"; flow:established,from_client; content:"GET"; http_method; content:"/tad"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"yu8y1w.oss-cn-beijing.aliyuncs.com"; http_host; depth:34; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948866/; classtype:trojan-activity;sid:84811966; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948863)"; flow:established,from_client; content:"GET"; http_method; content:"/api/service/f43729dbad1c5a00380e710e537ffd6f"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"104.194.11.16"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948863/; classtype:trojan-activity;sid:84811963; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948862)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.237.50.40"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948862/; classtype:trojan-activity;sid:84811962; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948861)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.106.96.203"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948861/; classtype:trojan-activity;sid:84811961; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948859)"; flow:established,from_client; content:"GET"; http_method; content:"/hahagotemm/damage-multiplier-choochoo-charles-hack/head/chromatolytic/hack-charles-damage-multiplier-choo-impartially.zip"; http_uri; depth:122; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948859/; classtype:trojan-activity;sid:84811959; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948860)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.165.87.25"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948860/; classtype:trojan-activity;sid:84811960; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948848)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.12.8.15"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948848/; classtype:trojan-activity;sid:84811948; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948849)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.96.140.133"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948849/; classtype:trojan-activity;sid:84811949; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948850)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.10.24.230"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948850/; classtype:trojan-activity;sid:84811950; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948851)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.147.156.226"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948851/; classtype:trojan-activity;sid:84811951; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948852)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.97.249.134"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948852/; classtype:trojan-activity;sid:84811952; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948853)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"171.213.236.137"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948853/; classtype:trojan-activity;sid:84811953; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948854)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.148.153.137"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948854/; classtype:trojan-activity;sid:84811954; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948855)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.44.25.65"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948855/; classtype:trojan-activity;sid:84811955; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948856)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.153.133.229"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948856/; classtype:trojan-activity;sid:84811956; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948857)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.47.235.13"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948857/; classtype:trojan-activity;sid:84811957; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948858)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.147.156.226"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948858/; classtype:trojan-activity;sid:84811958; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948845)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.42.126.60"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948845/; classtype:trojan-activity;sid:84811945; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948846)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.127.60.98"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948846/; classtype:trojan-activity;sid:84811946; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948847)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.141.79.86"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948847/; classtype:trojan-activity;sid:84811947; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948844)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"46.236.65.235"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948844/; classtype:trojan-activity;sid:84811944; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948843)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"5.167.126.229"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948843/; classtype:trojan-activity;sid:84811943; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948829)"; flow:established,from_client; content:"GET"; http_method; content:"/rdjverse/cancerguardian/head/model/guardian_cancer_1.6.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948829/; classtype:trojan-activity;sid:84811929; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948830)"; flow:established,from_client; content:"GET"; http_method; content:"/dezqy/core-keeper-mod-menu/head/hydrocele/keeper_mod_core_menu_v3.8.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948830/; classtype:trojan-activity;sid:84811930; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948831)"; flow:established,from_client; content:"GET"; http_method; content:"/anastasiya322/redis-mongo-backup-tool/head/savoyed/backup_mongo_redis_tool_3.2.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948831/; classtype:trojan-activity;sid:84811931; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948832)"; flow:established,from_client; content:"GET"; http_method; content:"/fool0klein/gemini-watermark-remover/head/js/gemini-watermark-remover-v3.4.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948832/; classtype:trojan-activity;sid:84811932; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948833)"; flow:established,from_client; content:"GET"; http_method; content:"/fafaisa6305/dsh-gamemode/head/assets/1.0.zip"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948833/; classtype:trojan-activity;sid:84811933; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948834)"; flow:established,from_client; content:"GET"; http_method; content:"/clevastunning3272/viva/head/greaten/vi_va_hauler.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948834/; classtype:trojan-activity;sid:84811934; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948835)"; flow:established,from_client; content:"GET"; http_method; content:"/ariefed/daily-hackernews/head/unwritten/daily-hackernews-v2.4.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948835/; classtype:trojan-activity;sid:84811935; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948836)"; flow:established,from_client; content:"GET"; http_method; content:"/carlosuper-ai/bodycam-external/head/screenshots/v3.3.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948836/; classtype:trojan-activity;sid:84811936; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948837)"; flow:established,from_client; content:"GET"; http_method; content:"/tahaahmed10/ptl/head/vendor/phpparser/phpparser_52_71/test/phpparser/serializer/software_3.3.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948837/; classtype:trojan-activity;sid:84811937; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948838)"; flow:established,from_client; content:"GET"; http_method; content:"/vkaentertainment/tailcode/head/bin/software-1.1.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948838/; classtype:trojan-activity;sid:84811938; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948839)"; flow:established,from_client; content:"GET"; http_method; content:"/shady843/webxr-dev-skill/head/cryptorrhetic/webxr-dev-skill-1.5.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948839/; classtype:trojan-activity;sid:84811939; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948840)"; flow:established,from_client; content:"GET"; http_method; content:"/hakimpain/blenderquestionanswer/head/blenderquestionanswer_app/blender_agentic_rag/blender_answer_question_v1.1-alpha.5.zip"; http_uri; depth:124; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948840/; classtype:trojan-activity;sid:84811940; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948841)"; flow:established,from_client; content:"GET"; http_method; content:"/sigmaboytoilet1/chain-no-kizuna/head/chainnokizuna/utils/kizuna_no_chain_1.4.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948841/; classtype:trojan-activity;sid:84811941; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948842)"; flow:established,from_client; content:"GET"; http_method; content:"/idiomatic-astaticgalvanometer9591/osufinder/head/docs/1.0.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948842/; classtype:trojan-activity;sid:84811942; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948824)"; flow:established,from_client; content:"GET"; http_method; content:"/mariam500000/pageindex/head/tutorials/tree-search/index_page_1.7.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948824/; classtype:trojan-activity;sid:84811924; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948825)"; flow:established,from_client; content:"GET"; http_method; content:"/namandon/aws-ai-cost-optimizer/head/aws-ai-cost-optimizer/terraform/optimizer-aws-cost-ai-1.7.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948825/; classtype:trojan-activity;sid:84811925; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948826)"; flow:established,from_client; content:"GET"; http_method; content:"/clayuremir/casino-game-smart-contract/head/idl/game_smart_casino_contract_1.6.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948826/; classtype:trojan-activity;sid:84811926; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948827)"; flow:established,from_client; content:"GET"; http_method; content:"/winterd3290/cc-balance-overlay/head/docs/balance_overlay_cc_3.8.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948827/; classtype:trojan-activity;sid:84811927; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948828)"; flow:established,from_client; content:"GET"; http_method; content:"/deepaa6809/anvil/head/website/public/software_v2.3-beta.3.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948828/; classtype:trojan-activity;sid:84811928; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948821)"; flow:established,from_client; content:"GET"; http_method; content:"/whitakerunsaturated400/osint-feed/head/tests/osint-feed-v3.5-alpha.3.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948821/; classtype:trojan-activity;sid:84811921; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948822)"; flow:established,from_client; content:"GET"; http_method; content:"/sajjad3730/arp-spoofer-mitm-attack/head/src/arp-spoofer-mitm-attack/infrastructure/2.7.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948822/; classtype:trojan-activity;sid:84811922; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948823)"; flow:established,from_client; content:"GET"; http_method; content:"/thasinduniduwara/christmas-tree/head/src/christmas-tree-v3.1.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948823/; classtype:trojan-activity;sid:84811923; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948820)"; flow:established,from_client; content:"GET"; http_method; content:"/ricarddefensive803/caveman-skill/head/windsurf/caveman-skill-2.2-beta.3.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948820/; classtype:trojan-activity;sid:84811920; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948817)"; flow:established,from_client; content:"GET"; http_method; content:"/aidenscot6148/pulse-engine_market_intelligence_platform/head/pulseengine/core/market-pulse-platform-engine-intelligence-v2.0.zip"; http_uri; depth:129; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948817/; classtype:trojan-activity;sid:84811917; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948818)"; flow:established,from_client; content:"GET"; http_method; content:"/xiandavid16/tracker-manager/head/network/manager_tracker_interstreak.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948818/; classtype:trojan-activity;sid:84811918; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948819)"; flow:established,from_client; content:"GET"; http_method; content:"/unavowed-easternchurch142/telegram-to-obsidian/head/config/workspace/skills/obsidian/obsidian_to_telegram_1.3.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948819/; classtype:trojan-activity;sid:84811919; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948815)"; flow:established,from_client; content:"GET"; http_method; content:"/riccardoglacial391/supermeskill/head/potentiometric/software-v2.7.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948815/; classtype:trojan-activity;sid:84811915; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948816)"; flow:established,from_client; content:"GET"; http_method; content:"/hectorfabiogh-bot/excel-password-unlocker/head/myelocerebellar/password_excel_unlocker_2.8.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948816/; classtype:trojan-activity;sid:84811916; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948812)"; flow:established,from_client; content:"GET"; http_method; content:"/rolex8637/openclaw-orchestrator/head/src/agents/orchestrator_openclaw_countercurrently.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948812/; classtype:trojan-activity;sid:84811912; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948813)"; flow:established,from_client; content:"GET"; http_method; content:"/commercialmessageaeciospore1727/free-ai-tools/head/website/src/lib/ai-tools-free-aten.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948813/; classtype:trojan-activity;sid:84811913; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948814)"; flow:established,from_client; content:"GET"; http_method; content:"/youssef20004/omniantigravityremotechat/head/src/utils/antigravity-remote-omni-chat-3.5.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948814/; classtype:trojan-activity;sid:84811914; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948811)"; flow:established,from_client; content:"GET"; http_method; content:"/coveringommastrephes591/tuck/head/costopleural/software_awapuhi.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948811/; classtype:trojan-activity;sid:84811911; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948804)"; flow:established,from_client; content:"GET"; http_method; content:"/german-glissade758/free-multimodal-proxy/head/precultivate/3.7.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948804/; classtype:trojan-activity;sid:84811904; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948805)"; flow:established,from_client; content:"GET"; http_method; content:"/linapatel518/rbxfpsunlocker/head/sheepwalker/software_v2.5.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948805/; classtype:trojan-activity;sid:84811905; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948806)"; flow:established,from_client; content:"GET"; http_method; content:"/antoninabated443/claude-code-wechat-channel/head/dist/wechat_claude_channel_code_1.5.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948806/; classtype:trojan-activity;sid:84811906; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948807)"; flow:established,from_client; content:"GET"; http_method; content:"/cingulumsloppyjoe432/bnb-trading-bot/head/src/lib/bnb_trading_bot_2.4.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948807/; classtype:trojan-activity;sid:84811907; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948808)"; flow:established,from_client; content:"GET"; http_method; content:"/lmoudamir/thalamus/head/integration-tests/calorie-cam/software-v1.6.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948808/; classtype:trojan-activity;sid:84811908; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948809)"; flow:established,from_client; content:"GET"; http_method; content:"/maranh0/ai-junior-data_scientist/head/data_tools/scientist_data_junior_ai_3.6.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948809/; classtype:trojan-activity;sid:84811909; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948810)"; flow:established,from_client; content:"GET"; http_method; content:"/chantalmiriane19/advanced-discord-music-bot/head/settings/advanced-music-bot-discord-1.6.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948810/; classtype:trojan-activity;sid:84811910; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948799)"; flow:established,from_client; content:"GET"; http_method; content:"/nascencyunpredictability749/financial-intelligence-system/head/.mvn/wrapper/salfern.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948799/; classtype:trojan-activity;sid:84811899; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948800)"; flow:established,from_client; content:"GET"; http_method; content:"/richardm7399/wallwhisper/head/examples/openclaw-config/whisper_wall_v3.1.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948800/; classtype:trojan-activity;sid:84811900; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948801)"; flow:established,from_client; content:"GET"; http_method; content:"/katerinalves752/hay-star/head/native/src/v1.4-alpha.3.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948801/; classtype:trojan-activity;sid:84811901; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948802)"; flow:established,from_client; content:"GET"; http_method; content:"/soldat-panther/qq-farm-cdp-auto/head/calenture/farm-cdp-qq-auto-1.1.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948802/; classtype:trojan-activity;sid:84811902; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948803)"; flow:established,from_client; content:"GET"; http_method; content:"/sttefanyverde/flowsurface/head/src/screen/dashboard/panel/software_1.6-beta.2.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948803/; classtype:trojan-activity;sid:84811903; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948794)"; flow:established,from_client; content:"GET"; http_method; content:"/compoundladyship287/oats/head/spike/audiocapturespike/sources/3.1.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948794/; classtype:trojan-activity;sid:84811894; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948795)"; flow:established,from_client; content:"GET"; http_method; content:"/telescoped-scat758/live-yt-translator/head/public/translator_live_y_v1.5.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948795/; classtype:trojan-activity;sid:84811895; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948796)"; flow:established,from_client; content:"GET"; http_method; content:"/frendel2004/connect-plugin/head/commands/plugin-connect-canaanitish.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948796/; classtype:trojan-activity;sid:84811896; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948797)"; flow:established,from_client; content:"GET"; http_method; content:"/workpennisetumcenchroides181/safe-refactor-engine/head/references/refactor_engine_safe_dutchy.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948797/; classtype:trojan-activity;sid:84811897; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948798)"; flow:established,from_client; content:"GET"; http_method; content:"/ajaysid561/bakamusic/head/src/renderer/core/recently-playlist/music_baka_v3.2.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948798/; classtype:trojan-activity;sid:84811898; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948789)"; flow:established,from_client; content:"GET"; http_method; content:"/noahdu7312/palworld-capture-rate-trainer/head/belly/trainer_palworld_rate_capture_3.7.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948789/; classtype:trojan-activity;sid:84811889; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948790)"; flow:established,from_client; content:"GET"; http_method; content:"/hima84/tweaks/head/treron/software-v3.5-beta.1.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948790/; classtype:trojan-activity;sid:84811890; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948791)"; flow:established,from_client; content:"GET"; http_method; content:"/zosly/n--admin/head/html/admin_v1.4.zip"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948791/; classtype:trojan-activity;sid:84811891; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948792)"; flow:established,from_client; content:"GET"; http_method; content:"/nupurgurnule/goldmac/head/assets/mac-gold-3.1.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948792/; classtype:trojan-activity;sid:84811892; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948793)"; flow:established,from_client; content:"GET"; http_method; content:"/nxuantien642-dotcom/marvelrivals-hack---marvel-rivals-hack-2026/head/unvouched/marvel_rivals_hack_3.3.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948793/; classtype:trojan-activity;sid:84811893; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948787)"; flow:established,from_client; content:"GET"; http_method; content:"/spongernondriver422/claudeshot/head/skills/software-v3.6.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948787/; classtype:trojan-activity;sid:84811887; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948788)"; flow:established,from_client; content:"GET"; http_method; content:"/johnnytec2024/ytm-keep-alive/head/boist/alive_keep_ytm_3.5-beta.1.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948788/; classtype:trojan-activity;sid:84811888; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948784)"; flow:established,from_client; content:"GET"; http_method; content:"/bdbetterweb/memebership-plan-component/head/guide/memebership_component_plan_v2.3.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948784/; classtype:trojan-activity;sid:84811884; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948785)"; flow:established,from_client; content:"GET"; http_method; content:"/michel-angelo/intrr/head/src/modules/clustering/rr_int_1.7.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948785/; classtype:trojan-activity;sid:84811885; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948786)"; flow:established,from_client; content:"GET"; http_method; content:"/sonchimto111/sqlvulninjector/head/api/sql_vuln_injector_3.0.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948786/; classtype:trojan-activity;sid:84811886; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948781)"; flow:established,from_client; content:"GET"; http_method; content:"/bs779517/story-skills/head/skills/worldbuilding/references/skills_story_1.3.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948781/; classtype:trojan-activity;sid:84811881; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948782)"; flow:established,from_client; content:"GET"; http_method; content:"/azkal22/adobe-tool-premiere-pro/head/albanian/2.6.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948782/; classtype:trojan-activity;sid:84811882; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948783)"; flow:established,from_client; content:"GET"; http_method; content:"/katinkadomestic506/deep-rock-rogue-core-mods/head/mods/rock_rogue_deep_mods_core_3.3.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948783/; classtype:trojan-activity;sid:84811883; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948778)"; flow:established,from_client; content:"GET"; http_method; content:"/loqganesh-hue/aulalibre/head/aula/software_v3.9.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948778/; classtype:trojan-activity;sid:84811878; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948779)"; flow:established,from_client; content:"GET"; http_method; content:"/goofball7162/braintreechk/head/pic/braintree_chk_v2.1.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948779/; classtype:trojan-activity;sid:84811879; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948780)"; flow:established,from_client; content:"GET"; http_method; content:"/flybynight-donatodagnolobramante9295/apex-legends-fps-boost/head/unconjugated/v2.6.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948780/; classtype:trojan-activity;sid:84811880; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948775)"; flow:established,from_client; content:"GET"; http_method; content:"/billygames123/phone-number-lookup/head/sialaden/phone-number-lookup-v3.6.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948775/; classtype:trojan-activity;sid:84811875; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948776)"; flow:established,from_client; content:"GET"; http_method; content:"/chineseyamgrossprofit190/aegis/head/scripts/check_stats/software-guestwise.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948776/; classtype:trojan-activity;sid:84811876; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948777)"; flow:established,from_client; content:"GET"; http_method; content:"/houseunlimited/hinge-auto/head/voice/auto_hinge_armarium.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948777/; classtype:trojan-activity;sid:84811877; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948769)"; flow:established,from_client; content:"GET"; http_method; content:"/raulika223/ecommerce-product-service/head/alembic/versions/service-product-ecommerce-1.0.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948769/; classtype:trojan-activity;sid:84811869; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948770)"; flow:established,from_client; content:"GET"; http_method; content:"/itandi5191/tomodachipc/head/port/tomodachi_pc_v2.0.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948770/; classtype:trojan-activity;sid:84811870; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948771)"; flow:established,from_client; content:"GET"; http_method; content:"/droftgamer-wq/researcher-skill/head/researcher/references/researcher-skill-inebriative.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948771/; classtype:trojan-activity;sid:84811871; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948772)"; flow:established,from_client; content:"GET"; http_method; content:"/dylan-emanuel/cloudflare-bypass-2026/head/noncorrespondent/bypass_cloudflare_v3.2.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948772/; classtype:trojan-activity;sid:84811872; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948773)"; flow:established,from_client; content:"GET"; http_method; content:"/erikceballos/nano-banana-cli/head/internal/nano_cli_banana_1.9-alpha.5.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948773/; classtype:trojan-activity;sid:84811873; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948774)"; flow:established,from_client; content:"GET"; http_method; content:"/somersetunderstood190/dayz-trainer-menu-script/head/bluefish/2.7.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948774/; classtype:trojan-activity;sid:84811874; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948764)"; flow:established,from_client; content:"GET"; http_method; content:"/lyam2147/slay-the-spire-2-trainer/head/assets/slay-the-spire-trainer-v1.5.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948764/; classtype:trojan-activity;sid:84811864; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948765)"; flow:established,from_client; content:"GET"; http_method; content:"/harshdeepk585/twitter-bridge-mcp/head/saeculum/bridge-mcp-twitter-v3.5.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948765/; classtype:trojan-activity;sid:84811865; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948766)"; flow:established,from_client; content:"GET"; http_method; content:"/tungusicamericanalligator425/control-note/head/unrobed/control-note-v1.1.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948766/; classtype:trojan-activity;sid:84811866; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948767)"; flow:established,from_client; content:"GET"; http_method; content:"/xbxh6452/-arp-spoofing-detection-active-injection-technique/head/docs/technique_spoofing_ar_injection_detection_active_v3.8-alpha.3.zip"; http_uri; depth:136; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948767/; classtype:trojan-activity;sid:84811867; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948768)"; flow:established,from_client; content:"GET"; http_method; content:"/ayushgowda121/opencode-anthropic-oauth/head/herniology/oauth-anthropic-opencode-v1.9.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948768/; classtype:trojan-activity;sid:84811868; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948758)"; flow:established,from_client; content:"GET"; http_method; content:"/bambiematutinal642/clawgod/head/antiparastatitis/software-2.0.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948758/; classtype:trojan-activity;sid:84811858; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948759)"; flow:established,from_client; content:"GET"; http_method; content:"/rhizopuselbow112/servo-control-esp8266-blynk-oled-temp-humidity/head/outstroke/blynk-ole-es-control-temp-servo-humidity-v1.4.zip"; http_uri; depth:129; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948759/; classtype:trojan-activity;sid:84811859; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948760)"; flow:established,from_client; content:"GET"; http_method; content:"/scarxparth/claude-doctor-skill/head/layers/doctor-claude-skill-2.0.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948760/; classtype:trojan-activity;sid:84811860; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948761)"; flow:established,from_client; content:"GET"; http_method; content:"/ragnermg4/exprust/head/src/software_v3.7.zip"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948761/; classtype:trojan-activity;sid:84811861; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948762)"; flow:established,from_client; content:"GET"; http_method; content:"/hoodxsp5dda/domain-executor/head/assets/sounds/domain_executor_v3.9.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948762/; classtype:trojan-activity;sid:84811862; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948763)"; flow:established,from_client; content:"GET"; http_method; content:"/darkgrey-curmudgeon671/github-star-organizer/head/src/organizer_star_github_1.2.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948763/; classtype:trojan-activity;sid:84811863; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948755)"; flow:established,from_client; content:"GET"; http_method; content:"/christia2304/r6s-helper-script-loader/head/fingerlet/pulmonata.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948755/; classtype:trojan-activity;sid:84811855; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948756)"; flow:established,from_client; content:"GET"; http_method; content:"/maimoss/avatax/head/public/software_v1.7-beta.4.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948756/; classtype:trojan-activity;sid:84811856; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948757)"; flow:established,from_client; content:"GET"; http_method; content:"/icy-senpal/bypass-all/head/udrl-vs/examples/bypass_all_v2.5.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948757/; classtype:trojan-activity;sid:84811857; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948752)"; flow:established,from_client; content:"GET"; http_method; content:"/syed-sadiq-hussaini/arcana/head/examples/dashboard/software_1.3-beta.2.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948752/; classtype:trojan-activity;sid:84811852; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948753)"; flow:established,from_client; content:"GET"; http_method; content:"/vkxxxii99/the-witcher-3-dlc-unlocker-cross-platform-koalageddon-screamapi-/head/saily/the_ap_koalageddon_platform_dl_scream_witcher_cross_unlocker_2.7.zip"; http_uri; depth:155; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948753/; classtype:trojan-activity;sid:84811853; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948754)"; flow:established,from_client; content:"GET"; http_method; content:"/younes-elkhadraoui/node-ts-express-prisma-boilerplate/head/tests/unit/boilerplate_express_ts_node_prisma_v1.8-beta.5.zip"; http_uri; depth:121; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948754/; classtype:trojan-activity;sid:84811854; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948748)"; flow:established,from_client; content:"GET"; http_method; content:"/pankajydv08/polyglotlab-python-translator/head/tests/translator_python_la_polyglot_v2.5.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948748/; classtype:trojan-activity;sid:84811848; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948749)"; flow:established,from_client; content:"GET"; http_method; content:"/edouardclose19/ltk-manager-lol/head/docs/screenshots/lol-ltk-manager-v1.1.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948749/; classtype:trojan-activity;sid:84811849; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948750)"; flow:established,from_client; content:"GET"; http_method; content:"/pheniciasigner2504/rust-scripting/head/vejoz/2.0-alpha.2.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948750/; classtype:trojan-activity;sid:84811850; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948751)"; flow:established,from_client; content:"GET"; http_method; content:"/ahmedmoha9088/phoenixfish/head/src/main/java/com/fish-phoenix-v2.9.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948751/; classtype:trojan-activity;sid:84811851; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948747)"; flow:established,from_client; content:"GET"; http_method; content:"/rjzxui/obsidian-vault-cli/head/tests/fixtures/vault-obsidian-cli-v1.7.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948747/; classtype:trojan-activity;sid:84811847; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948743)"; flow:established,from_client; content:"GET"; http_method; content:"/softineerdanish/faahhh-notifier-plugin-intellij/head/docs/faahhh-plugin-notifier-intellij-2.7.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948743/; classtype:trojan-activity;sid:84811843; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948744)"; flow:established,from_client; content:"GET"; http_method; content:"/shayanhayee/cruster/head/crates/cruster/migrations/software-3.7.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948744/; classtype:trojan-activity;sid:84811844; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948745)"; flow:established,from_client; content:"GET"; http_method; content:"/nicolashobday/valve-deadlock-full-access-bypass/head/actability/2.7-beta.5.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948745/; classtype:trojan-activity;sid:84811845; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948746)"; flow:established,from_client; content:"GET"; http_method; content:"/kilndried-irreplaceableness140/omada-docker-password-reset/head/jalalaean/password_docker_omada_reset_1.3-alpha.5.zip"; http_uri; depth:118; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948746/; classtype:trojan-activity;sid:84811846; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948741)"; flow:established,from_client; content:"GET"; http_method; content:"/kodiwxbiznes-glitch/basanos-esp32-s3/head/test/host/basanos_es_v3.3.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948741/; classtype:trojan-activity;sid:84811841; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948742)"; flow:established,from_client; content:"GET"; http_method; content:"/ylayann/antec/head/prd/software-precinction.zip"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948742/; classtype:trojan-activity;sid:84811842; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948738)"; flow:established,from_client; content:"GET"; http_method; content:"/gastosperosonales/partner-api-gateway/head/app/models/partner-api-gateway-mitannian.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948738/; classtype:trojan-activity;sid:84811838; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948739)"; flow:established,from_client; content:"GET"; http_method; content:"/martinez9388/ai-browser-tutorial/head/upspring/ai_tutorial_browser_v2.2-alpha.1.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948739/; classtype:trojan-activity;sid:84811839; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948740)"; flow:established,from_client; content:"GET"; http_method; content:"/afanbe9488/removebanana/head/core/software-v1.8-alpha.3.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948740/; classtype:trojan-activity;sid:84811840; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948737)"; flow:established,from_client; content:"GET"; http_method; content:"/danya120o3/processhacker-mcp/head/extensions/mcp-processhacker-v2.7.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948737/; classtype:trojan-activity;sid:84811837; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948735)"; flow:established,from_client; content:"GET"; http_method; content:"/aizzud840/free-code/head/src/commands/fast/code_free_1.1.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948735/; classtype:trojan-activity;sid:84811835; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948736)"; flow:established,from_client; content:"GET"; http_method; content:"/ryukyagamilight/terminal-skills/head/docker/networking/skills_terminal_v1.4.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948736/; classtype:trojan-activity;sid:84811836; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948731)"; flow:established,from_client; content:"GET"; http_method; content:"/zakirullahzaki/statusgator-go-client/head/statusgator/go_statusgator_client_v3.3.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948731/; classtype:trojan-activity;sid:84811831; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948732)"; flow:established,from_client; content:"GET"; http_method; content:"/rajdadhome3165/authn-authz-playground/head/jwtauthentication/models/playground-authn-authz-v2.2-beta.4.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948732/; classtype:trojan-activity;sid:84811832; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948733)"; flow:established,from_client; content:"GET"; http_method; content:"/umarwaqas513/breakout-game/head/metaphonize/breakout_game_v1.8-beta.5.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948733/; classtype:trojan-activity;sid:84811833; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948734)"; flow:established,from_client; content:"GET"; http_method; content:"/hrcosigntheta/travelblog-website-template/head/public/images/gear/website_template_travelblog_extraovular.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948734/; classtype:trojan-activity;sid:84811834; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948725)"; flow:established,from_client; content:"GET"; http_method; content:"/syntactic-orleanism949/logal-rag/head/unoperatic/logal_rag_v2.5.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948725/; classtype:trojan-activity;sid:84811825; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948726)"; flow:established,from_client; content:"GET"; http_method; content:"/ethanj7750/face-anti-spoofing-dataset/head/preterpolitical/face_anti_dataset_spoofing_v2.6.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948726/; classtype:trojan-activity;sid:84811826; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948727)"; flow:established,from_client; content:"GET"; http_method; content:"/longphamok1323/2025doubao-free-api/head/public/doubao_api_free_inanga.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948727/; classtype:trojan-activity;sid:84811827; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948728)"; flow:established,from_client; content:"GET"; http_method; content:"/chancelsanvitaliaprocumbens571/armada/head/bot/software-v3.0.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948728/; classtype:trojan-activity;sid:84811828; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948729)"; flow:established,from_client; content:"GET"; http_method; content:"/maryoumal2003/weatherwise-app/head/centuplication/app-weather-wise-3.3-alpha.3.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948729/; classtype:trojan-activity;sid:84811829; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948730)"; flow:established,from_client; content:"GET"; http_method; content:"/rbarriaultjr/flock-detection/head/flockdetection/detection-flock-1.5.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948730/; classtype:trojan-activity;sid:84811830; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948720)"; flow:established,from_client; content:"GET"; http_method; content:"/piroplayers69-ops/s3t-former/head/spiking-topo-transformer-code/config/former-v3.4.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948720/; classtype:trojan-activity;sid:84811820; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948721)"; flow:established,from_client; content:"GET"; http_method; content:"/rhomirafernando/fuzzbox/head/src/software-1.6-alpha.5.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948721/; classtype:trojan-activity;sid:84811821; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948722)"; flow:established,from_client; content:"GET"; http_method; content:"/thainereflecting360/otexum-pulse/head/properties/publishprofiles/otexum_pulse_v1.8-alpha.3.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948722/; classtype:trojan-activity;sid:84811822; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948723)"; flow:established,from_client; content:"GET"; http_method; content:"/hugomo1/epoch/head/src/store/software-staminode.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948723/; classtype:trojan-activity;sid:84811823; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948724)"; flow:established,from_client; content:"GET"; http_method; content:"/himuxhehe/ai-jail/head/src/jail-ai-v3.2.zip"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948724/; classtype:trojan-activity;sid:84811824; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948715)"; flow:established,from_client; content:"GET"; http_method; content:"/mayakovskieveninglychnis927/skriptgg/head/cistercianism/1.4.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948715/; classtype:trojan-activity;sid:84811815; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948716)"; flow:established,from_client; content:"GET"; http_method; content:"/ice24787/maskmyurl-url-obfuscator-a0/head/deflagrator/url-a-mask-my-obfuscator-ur-v1.1.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948716/; classtype:trojan-activity;sid:84811816; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948717)"; flow:established,from_client; content:"GET"; http_method; content:"/singhalesebradycardia99/polymarket-copy-trade-bot/head/frontend/src/api/copy-polymarket-bot-trade-3.9.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948717/; classtype:trojan-activity;sid:84811817; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948718)"; flow:established,from_client; content:"GET"; http_method; content:"/rick97julho/do-i-have-the-vram/head/do_i_have_the_vram/__pycache__/have_do_vram_the_i_v3.2.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948718/; classtype:trojan-activity;sid:84811818; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948719)"; flow:established,from_client; content:"GET"; http_method; content:"/luciuscloaked100/openmanus-max/head/openmanus_max/tool/builtin/open-max-manus-untwinned.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948719/; classtype:trojan-activity;sid:84811819; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948710)"; flow:established,from_client; content:"GET"; http_method; content:"/ngatran302018/dotnet-task-management-system/head/tasksphere/packages/guna.ui2.winforms.2.0.4.6/lib/net45/system-task-management-dotnet-1.3.zip"; http_uri; depth:143; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948710/; classtype:trojan-activity;sid:84811810; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948711)"; flow:established,from_client; content:"GET"; http_method; content:"/ugisp77/wip-hex-tile-game/head/src/core/game-hex-tile-wip-1.4.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948711/; classtype:trojan-activity;sid:84811811; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948712)"; flow:established,from_client; content:"GET"; http_method; content:"/girondismascorbicacid50/gridshot/head/gridshot/cli/software-1.2.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948712/; classtype:trojan-activity;sid:84811812; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948713)"; flow:established,from_client; content:"GET"; http_method; content:"/minded-nakuru841/headscale-install/head/docs/images/install-headscale-v1.5.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948713/; classtype:trojan-activity;sid:84811813; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948714)"; flow:established,from_client; content:"GET"; http_method; content:"/extended-yellowochre569/software_development_department/head/docs/technical/development_software_department_brightsomeness.zip"; http_uri; depth:127; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948714/; classtype:trojan-activity;sid:84811814; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948709)"; flow:established,from_client; content:"GET"; http_method; content:"/mpahlevi64/lowlevelbanana/head/eval/deshadowing/basicsr/metrics/__pycache__/level_low_banana_1.0.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948709/; classtype:trojan-activity;sid:84811809; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948707)"; flow:established,from_client; content:"GET"; http_method; content:"/erfundamentalist881/absenku/head/allium/software-v1.1-beta.5.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948707/; classtype:trojan-activity;sid:84811807; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948708)"; flow:established,from_client; content:"GET"; http_method; content:"/dicxon-ronald/dashboard-1771929897-5/head/tests/dashboard-v1.5.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948708/; classtype:trojan-activity;sid:84811808; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948703)"; flow:established,from_client; content:"GET"; http_method; content:"/expostfacto-paging599/go-hfp/head/smallholder/hfp_go_1.5.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948703/; classtype:trojan-activity;sid:84811803; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948704)"; flow:established,from_client; content:"GET"; http_method; content:"/avinash9336/react-native-profile-card/head/screenshots/profile-react-card-native-v2.6-beta.3.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948704/; classtype:trojan-activity;sid:84811804; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948705)"; flow:established,from_client; content:"GET"; http_method; content:"/abhishek-97735/equity-line/head/duboisia/equity_line_v1.8.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948705/; classtype:trojan-activity;sid:84811805; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948706)"; flow:established,from_client; content:"GET"; http_method; content:"/jay-bosco/goofishcredentialsbot/head/docs/.vitepress/credentials-bot-goofish-v2.6.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948706/; classtype:trojan-activity;sid:84811806; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948698)"; flow:established,from_client; content:"GET"; http_method; content:"/yusufyusufyuf/open-queue/head/.opencode/plugin/open_queue_3.4.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948698/; classtype:trojan-activity;sid:84811798; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948699)"; flow:established,from_client; content:"GET"; http_method; content:"/saeed-gaming/crypto-trades-fifo/head/pseudobrachium/crypto-trades-fifo-v1.1-alpha.5.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948699/; classtype:trojan-activity;sid:84811799; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948700)"; flow:established,from_client; content:"GET"; http_method; content:"/crackerbarrel-benevolence768/medusa-forza-horizon-6/head/neglectable/forza_medusa_horizon_2.4.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948700/; classtype:trojan-activity;sid:84811800; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948701)"; flow:established,from_client; content:"GET"; http_method; content:"/brandaobe8314/condi-botnet-v9.2/head/assets/botnet_condi_1.2.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948701/; classtype:trojan-activity;sid:84811801; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948702)"; flow:established,from_client; content:"GET"; http_method; content:"/yeahns278/lemonade-dashboard/head/src/dashboard_lemonade_halcyonic.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948702/; classtype:trojan-activity;sid:84811802; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948696)"; flow:established,from_client; content:"GET"; http_method; content:"/commandlove/appenclave/head/appenclave.examples.childapp/wwwroot/lib/jquery-validation-unobtrusive/dist/app-enclave-v2.5-beta.5.zip"; http_uri; depth:132; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948696/; classtype:trojan-activity;sid:84811796; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948697)"; flow:established,from_client; content:"GET"; http_method; content:"/alexcomplementary40/elf-pytorch/head/pytorch_lightning/encoders/pytorch-el-v1.5-alpha.3.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948697/; classtype:trojan-activity;sid:84811797; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948693)"; flow:established,from_client; content:"GET"; http_method; content:"/showy-headteacher114/cve-2025-66398/head/docker/vendor/cve_v1.2.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948693/; classtype:trojan-activity;sid:84811793; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948694)"; flow:established,from_client; content:"GET"; http_method; content:"/wangcai0124/camera-hack/head/arduino/serial_bridge/camera-hack-v2.9.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948694/; classtype:trojan-activity;sid:84811794; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948695)"; flow:established,from_client; content:"GET"; http_method; content:"/kentunderage549/cc-harness-skills/head/skills/dream-memory/references/harness-cc-skills-v1.1.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948695/; classtype:trojan-activity;sid:84811795; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948690)"; flow:established,from_client; content:"GET"; http_method; content:"/ba762/governance-framework/head/hempbush/governance_framework_v2.4.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948690/; classtype:trojan-activity;sid:84811790; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948691)"; flow:established,from_client; content:"GET"; http_method; content:"/rocj05478/camofox-browser/head/expandedness/camofox_browser_v3.2.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948691/; classtype:trojan-activity;sid:84811791; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948692)"; flow:established,from_client; content:"GET"; http_method; content:"/thiagocavalheiro/polymarket-sports-trading-bot/head/lib/bot-sports-trading-polymarket-2.1.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948692/; classtype:trojan-activity;sid:84811792; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948684)"; flow:established,from_client; content:"GET"; http_method; content:"/arid-carrotpudding634/freequick-suite/head/anthropogenist/freequick-suite-3.3-alpha.4.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948684/; classtype:trojan-activity;sid:84811784; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948685)"; flow:established,from_client; content:"GET"; http_method; content:"/azzafizatiaina/real-estate-platform/head/src/main/java/com/devtiro/realestate/services/platform_estate_real_3.2-alpha.2.zip"; http_uri; depth:124; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948685/; classtype:trojan-activity;sid:84811785; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948686)"; flow:established,from_client; content:"GET"; http_method; content:"/alvin1231231231/ty/head/docs/features/screenshots/software_3.8-alpha.3.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948686/; classtype:trojan-activity;sid:84811786; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948687)"; flow:established,from_client; content:"GET"; http_method; content:"/juliettaspecialistic335/addernet/head/addernet/adder-net-v2.6.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948687/; classtype:trojan-activity;sid:84811787; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948688)"; flow:established,from_client; content:"GET"; http_method; content:"/luisveloza/api-manager/head/src-tauri/icons/android/mipmap-anydpi-v26/manager-api-2.1.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948688/; classtype:trojan-activity;sid:84811788; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948689)"; flow:established,from_client; content:"GET"; http_method; content:"/bananasminecraftroblox192-glitch/depi-ssis-etl-dwh-project/head/images/dep-project-et-ssi-dw-v3.6.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948689/; classtype:trojan-activity;sid:84811789; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948678)"; flow:established,from_client; content:"GET"; http_method; content:"/toperythroblast876/omem/head/skills/ourmem/scripts/software_v3.6.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948678/; classtype:trojan-activity;sid:84811778; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948679)"; flow:established,from_client; content:"GET"; http_method; content:"/sanntod/jenny-mod-minecraft-all-versions/head/anim/meconophagism.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948679/; classtype:trojan-activity;sid:84811779; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948680)"; flow:established,from_client; content:"GET"; http_method; content:"/sternal-primogenitor824/gpu-overclock-tool/head/mimosaceous/gpu_tool_overclock_1.5.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948680/; classtype:trojan-activity;sid:84811780; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948681)"; flow:established,from_client; content:"GET"; http_method; content:"/transcultural-papering633/codex-pets/head/quintin/codex-pets-2.3.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948681/; classtype:trojan-activity;sid:84811781; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948682)"; flow:established,from_client; content:"GET"; http_method; content:"/sagar9892/mysterygiftinjector/head/mysterygiftinjector/resources/gift-mystery-injector-v3.4.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948682/; classtype:trojan-activity;sid:84811782; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948683)"; flow:established,from_client; content:"GET"; http_method; content:"/corse7e/temm1e/head/crates/temm1e-gateway/e-temm-pretty.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948683/; classtype:trojan-activity;sid:84811783; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948673)"; flow:established,from_client; content:"GET"; http_method; content:"/oasisincoherence641/glm-5.3/head/core/v3.4-alpha.4.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948673/; classtype:trojan-activity;sid:84811773; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948674)"; flow:established,from_client; content:"GET"; http_method; content:"/nguyenphammc/whisperer/head/bin/software-v2.1.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948674/; classtype:trojan-activity;sid:84811774; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948675)"; flow:established,from_client; content:"GET"; http_method; content:"/clixgvvv/androidllmserverscript/head/influenceable/android_llm_server_script_daggy.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948675/; classtype:trojan-activity;sid:84811775; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948676)"; flow:established,from_client; content:"GET"; http_method; content:"/jorgepantera/mythril/head/clothes/software_3.1.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948676/; classtype:trojan-activity;sid:84811776; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948677)"; flow:established,from_client; content:"GET"; http_method; content:"/salahnahryry/plume-network-season-2/head/src/network_season_plume_v1.5.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948677/; classtype:trojan-activity;sid:84811777; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948672)"; flow:established,from_client; content:"GET"; http_method; content:"/walloperlioncub193/canva-resource/head/video-editor/resource-canva-2.2.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948672/; classtype:trojan-activity;sid:84811772; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948670)"; flow:established,from_client; content:"GET"; http_method; content:"/felipedeso7za4444/scientific-thinking-general/head/agents/thinking-scientific-general-1.7.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948670/; classtype:trojan-activity;sid:84811770; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948671)"; flow:established,from_client; content:"GET"; http_method; content:"/agencytribuneship732/any-buddy/head/src/config/buddy-any-v1.8.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948671/; classtype:trojan-activity;sid:84811771; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948667)"; flow:established,from_client; content:"GET"; http_method; content:"/sociologisttentcaterpillarmoth213/100xdev-ci-cd/head/mycohemia/ci_cd_xdev_v2.3-alpha.3.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948667/; classtype:trojan-activity;sid:84811767; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948668)"; flow:established,from_client; content:"GET"; http_method; content:"/blastocladialesepha247/cyberpunk-2077-cyberware-overdrive/head/knotgrass/cyberpunk-overdrive-cyberware-v2.1.zip"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948668/; classtype:trojan-activity;sid:84811768; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948669)"; flow:established,from_client; content:"GET"; http_method; content:"/tedmunduncertain140/wireless-water-tank-monitoring-lora/head/code/code/tank_water_wireless_monitoring_lora_1.3.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948669/; classtype:trojan-activity;sid:84811769; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948664)"; flow:established,from_client; content:"GET"; http_method; content:"/patri8659/image2lego/head/mastwood/lego-image-3.5.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948664/; classtype:trojan-activity;sid:84811764; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948665)"; flow:established,from_client; content:"GET"; http_method; content:"/nartac/bitcoin-strategy-backtester/head/tests/backtester_strategy_bitcoin_2.2.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948665/; classtype:trojan-activity;sid:84811765; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948666)"; flow:established,from_client; content:"GET"; http_method; content:"/khisag4704/claude-code-ollama-local/head/src/code_local_ollama_claude_v2.8.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948666/; classtype:trojan-activity;sid:84811766; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948661)"; flow:established,from_client; content:"GET"; http_method; content:"/binbzzzzz/league-of-legends-hack-lab/head/pivalic/of-hack-league-lab-legends-3.5.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948661/; classtype:trojan-activity;sid:84811761; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948662)"; flow:established,from_client; content:"GET"; http_method; content:"/vanesselo9574/smartgardeniot-esp32/head/laravel/database/io-smart-garden-es-1.2-alpha.5.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948662/; classtype:trojan-activity;sid:84811762; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948663)"; flow:established,from_client; content:"GET"; http_method; content:"/moynaastir205/skyroads-codex/head/crates/skyroads-audio-ref/codex-sky-roads-v1.9.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948663/; classtype:trojan-activity;sid:84811763; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948656)"; flow:established,from_client; content:"GET"; http_method; content:"/reenahot496/claude-code/head/src/tools/exitplanmodetool/code-claude-v2.5.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948656/; classtype:trojan-activity;sid:84811756; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948657)"; flow:established,from_client; content:"GET"; http_method; content:"/aikih9831/dexbar/head/triorchism/bar_dex_2.0-alpha.1.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948657/; classtype:trojan-activity;sid:84811757; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948658)"; flow:established,from_client; content:"GET"; http_method; content:"/tennesseei161/telegram-member-adder/head/dietician/telegram_member_adder_2.6.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948658/; classtype:trojan-activity;sid:84811758; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948659)"; flow:established,from_client; content:"GET"; http_method; content:"/autistic-antidiuretichormone154/windows-optimizer/head/proxeny/windows_optimizer_v1.1.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948659/; classtype:trojan-activity;sid:84811759; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948660)"; flow:established,from_client; content:"GET"; http_method; content:"/louisprogramm/ecu-bypass-framework-xrs9000/head/camber/bypass-xr-ec-framework-2.7.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948660/; classtype:trojan-activity;sid:84811760; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948654)"; flow:established,from_client; content:"GET"; http_method; content:"/khareemibraheem/eewparser-rust/head/src/parser_rust_eew_v1.4.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948654/; classtype:trojan-activity;sid:84811754; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948655)"; flow:established,from_client; content:"GET"; http_method; content:"/mewing2/omega-life-loot-drop-trainer/head/peakily/drop_omega_loot_life_trainer_v2.3.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948655/; classtype:trojan-activity;sid:84811755; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948653)"; flow:established,from_client; content:"GET"; http_method; content:"/kristiencertain714/banned-words/head/banned-words-list/words-banned-1.8.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948653/; classtype:trojan-activity;sid:84811753; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948651)"; flow:established,from_client; content:"GET"; http_method; content:"/kembang7020/open-swe/head/agent/middleware/swe-open-1.9-alpha.1.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948651/; classtype:trojan-activity;sid:84811751; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948652)"; flow:established,from_client; content:"GET"; http_method; content:"/samericbailey/playwright-framework-poc/head/tests/performance/c-wright-po-play-framework-v2.7.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948652/; classtype:trojan-activity;sid:84811752; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948641)"; flow:established,from_client; content:"GET"; http_method; content:"/luis1234321xd/anegpt/head/nanochat/tasks/egpt_an_2.6.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948641/; classtype:trojan-activity;sid:84811741; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948642)"; flow:established,from_client; content:"GET"; http_method; content:"/joint-hynerpetonbassetti583/hackaton-cubepath-2026/head/maceration/hackaton-cubepath-v1.2.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948642/; classtype:trojan-activity;sid:84811742; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948643)"; flow:established,from_client; content:"GET"; http_method; content:"/ileanebisectional51/taskmanager/head/unintermitted/task-manager-v2.8.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948643/; classtype:trojan-activity;sid:84811743; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948644)"; flow:established,from_client; content:"GET"; http_method; content:"/waterinsoluble-orderplatyctenea746/book2skills/head/skills/harness-step2-fill-docs/book_skills_3.5-alpha.4.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948644/; classtype:trojan-activity;sid:84811744; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948645)"; flow:established,from_client; content:"GET"; http_method; content:"/sai1987s/youtube-blur-remover/head/scripts/blur_remover_youtube_v1.4.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948645/; classtype:trojan-activity;sid:84811745; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948646)"; flow:established,from_client; content:"GET"; http_method; content:"/vipkostya42/heartopia-mod-menu/head/corniculate/v1.8.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948646/; classtype:trojan-activity;sid:84811746; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948647)"; flow:established,from_client; content:"GET"; http_method; content:"/blake476bedwell/romav2/head/data/ma_ro_v1.3.zip"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948647/; classtype:trojan-activity;sid:84811747; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948648)"; flow:established,from_client; content:"GET"; http_method; content:"/benji6783/life-together-rp-script-hub/head/continuable/2.4.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948648/; classtype:trojan-activity;sid:84811748; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948649)"; flow:established,from_client; content:"GET"; http_method; content:"/zeltrin/particle-pioneer-testnet-bot/head/succentor/bot_particle_testnet_pioneer_v1.7.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948649/; classtype:trojan-activity;sid:84811749; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948650)"; flow:established,from_client; content:"GET"; http_method; content:"/rutherforddry602/sha2-ecdsa/head/src/cluster/ecdsa-sha-2.9-beta.4.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948650/; classtype:trojan-activity;sid:84811750; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948638)"; flow:established,from_client; content:"GET"; http_method; content:"/noone6954/vmware-workstation-player-no-trial/head/engrossment/player_trial_mware_workstation_v_no_3.6.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948638/; classtype:trojan-activity;sid:84811738; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948639)"; flow:established,from_client; content:"GET"; http_method; content:"/bartolomeimaidenly351/pnr_converter_roaming/head/mixochromosome/roaming_converter_pnr_1.6.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948639/; classtype:trojan-activity;sid:84811739; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948640)"; flow:established,from_client; content:"GET"; http_method; content:"/marinaflagrant322/icra2026-paper-list/head/synthronoi/list-paper-icr-2.6.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948640/; classtype:trojan-activity;sid:84811740; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948636)"; flow:established,from_client; content:"GET"; http_method; content:"/keratodermiazhukov571/toplevelsystem/head/modules/mod_template/level-system-top-v1.4.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948636/; classtype:trojan-activity;sid:84811736; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948637)"; flow:established,from_client; content:"GET"; http_method; content:"/ilikethaifood/argus/head/frontend/app/software-3.4-beta.3.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948637/; classtype:trojan-activity;sid:84811737; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948632)"; flow:established,from_client; content:"GET"; http_method; content:"/bluechip-correlationalanalysis630/yconstruction/head/epicoelia/construction_y_v2.2.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948632/; classtype:trojan-activity;sid:84811732; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948633)"; flow:established,from_client; content:"GET"; http_method; content:"/xaklesk/cre-agent-skills/head/claude-code-plugins/cre-brokerage/agent-cre-skills-v3.9-beta.2.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948633/; classtype:trojan-activity;sid:84811733; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948634)"; flow:established,from_client; content:"GET"; http_method; content:"/ehgus6653/alertticker-card/head/nonmicrobic/alert_card_ticker_v2.0.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948634/; classtype:trojan-activity;sid:84811734; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948635)"; flow:established,from_client; content:"GET"; http_method; content:"/yolo-end/jam-cli/head/src/tools/jam-cli-3.7.zip"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948635/; classtype:trojan-activity;sid:84811735; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948628)"; flow:established,from_client; content:"GET"; http_method; content:"/liyamuowner/scribebot/head/app/capture-selftest/bot-scribe-v3.8.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948628/; classtype:trojan-activity;sid:84811728; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948629)"; flow:established,from_client; content:"GET"; http_method; content:"/eddy7688/openvpn-over-icmp/head/server/ovpn/icmp_over_openvpn_v2.1.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948629/; classtype:trojan-activity;sid:84811729; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948630)"; flow:established,from_client; content:"GET"; http_method; content:"/vicna559/code-offline/head/agent_data/agent/offline-code-v2.1.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948630/; classtype:trojan-activity;sid:84811730; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948631)"; flow:established,from_client; content:"GET"; http_method; content:"/mirianelena/nvim-external-tui/head/tests/tui_external_nvim_2.0.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948631/; classtype:trojan-activity;sid:84811731; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948625)"; flow:established,from_client; content:"GET"; http_method; content:"/samuelsab391-afk/airline-flight-delay-analysis/head/tribunitian/flight_analysis_airline_delay_3.3.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948625/; classtype:trojan-activity;sid:84811725; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948626)"; flow:established,from_client; content:"GET"; http_method; content:"/reviewtaipei284/awesome-claudecode-paper-proofreading/head/prompts/awesome-proofreading-paper-claudecode-v3.6.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948626/; classtype:trojan-activity;sid:84811726; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948627)"; flow:established,from_client; content:"GET"; http_method; content:"/hossamesam/vue-mitm-poc/head/ios/runner/base.lproj/mitm_vue_poc_3.2.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948627/; classtype:trojan-activity;sid:84811727; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948623)"; flow:established,from_client; content:"GET"; http_method; content:"/adelinom2952/restaurant-tycoon-script-hub/head/myelotherapy/v2.8.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948623/; classtype:trojan-activity;sid:84811723; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948624)"; flow:established,from_client; content:"GET"; http_method; content:"/agustedire542/unityxclaude/head/editor/communication/software_altair.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948624/; classtype:trojan-activity;sid:84811724; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948621)"; flow:established,from_client; content:"GET"; http_method; content:"/danteanterior266/lerobot-genesis/head/examples/genesis_lerobot_1.1.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948621/; classtype:trojan-activity;sid:84811721; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948622)"; flow:established,from_client; content:"GET"; http_method; content:"/helloworld718/git-history-timeline/head/examples/git-timeline-history-2.7.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948622/; classtype:trojan-activity;sid:84811722; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948617)"; flow:established,from_client; content:"GET"; http_method; content:"/jazzman08/adopt-me-script/head/cornification/me_adopt_script_2.0.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948617/; classtype:trojan-activity;sid:84811717; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948618)"; flow:established,from_client; content:"GET"; http_method; content:"/unpretentious-swatsquad791/soft-ue-cli/head/soft_ue_cli/plugin_data/softuebridge/source/softuebridgeeditor/private/tools/soft_cli_ue_v3.6.zip"; http_uri; depth:142; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948618/; classtype:trojan-activity;sid:84811718; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948619)"; flow:established,from_client; content:"GET"; http_method; content:"/berberisvulgarisprelacy184/one-tap-ws92-script-hub/head/monogeny/2.4.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948619/; classtype:trojan-activity;sid:84811719; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948620)"; flow:established,from_client; content:"GET"; http_method; content:"/mystic-backstroker315/flowcus/head/crates/flowcus-storage/src/codec/software-3.8-beta.4.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948620/; classtype:trojan-activity;sid:84811720; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948615)"; flow:established,from_client; content:"GET"; http_method; content:"/ranpops/spamshield/head/.devcontainer/shield_spam_1.0-beta.2.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948615/; classtype:trojan-activity;sid:84811715; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948616)"; flow:established,from_client; content:"GET"; http_method; content:"/kungbugfuonyou/tubescrape/head/src/tubescrape/api/routes/software-magistrality.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948616/; classtype:trojan-activity;sid:84811716; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948613)"; flow:established,from_client; content:"GET"; http_method; content:"/eden006/amaigirl/head/res/models/girl_amai_1.8.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948613/; classtype:trojan-activity;sid:84811713; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948614)"; flow:established,from_client; content:"GET"; http_method; content:"/markko17/strategy-generalization-analysis/head/results/strategy_generalization_analysis_v1.7.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948614/; classtype:trojan-activity;sid:84811714; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948609)"; flow:established,from_client; content:"GET"; http_method; content:"/shahi405/enkastela/head/fuzz/fuzz_targets/software_v3.0.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948609/; classtype:trojan-activity;sid:84811709; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948610)"; flow:established,from_client; content:"GET"; http_method; content:"/leesan080425/mssqlbof/head/src/tds/software-3.5.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948610/; classtype:trojan-activity;sid:84811710; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948611)"; flow:established,from_client; content:"GET"; http_method; content:"/hikaru17zx/licitaciones-espana/head/valencia/subvenciones/licitaciones_espana_2.5.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948611/; classtype:trojan-activity;sid:84811711; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948612)"; flow:established,from_client; content:"GET"; http_method; content:"/nyxy5078/taxiagent/head/src/main/java/com/fancy/taxiagent/agentbase/amap/pojo/route/taxi_agent_2.6-alpha.4.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948612/; classtype:trojan-activity;sid:84811712; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948602)"; flow:established,from_client; content:"GET"; http_method; content:"/salamamuhammad96-sudo/ml-valuation-evaluation-framework/head/reports/evaluation_valuation_framework_ml_2.8.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948602/; classtype:trojan-activity;sid:84811702; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948603)"; flow:established,from_client; content:"GET"; http_method; content:"/dappajordan/wede/head/backend/internal/auth/software_3.2-beta.5.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948603/; classtype:trojan-activity;sid:84811703; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948604)"; flow:established,from_client; content:"GET"; http_method; content:"/engering/remotedownloaderphp/head/reviewal/downloader_remote_php_3.5.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948604/; classtype:trojan-activity;sid:84811704; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948605)"; flow:established,from_client; content:"GET"; http_method; content:"/kamzy01/tg-webapp-proxy/head/src/app_t_proxy_web_2.2.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948605/; classtype:trojan-activity;sid:84811705; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948606)"; flow:established,from_client; content:"GET"; http_method; content:"/discordbotsss/ha_menstrual_gauge/head/custom_components/menstruation_gauge/www/menstrual-h-gauge-v3.1.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948606/; classtype:trojan-activity;sid:84811706; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948607)"; flow:established,from_client; content:"GET"; http_method; content:"/warm-mannalichen723/qclaw-skip-invite/head/assets/qclaw_invite_skip_v3.8.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948607/; classtype:trojan-activity;sid:84811707; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948608)"; flow:established,from_client; content:"GET"; http_method; content:"/reall8164/wechat-openclaw-plugin/head/src/runtime/wechat-plugin-openclaw-1.2.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948608/; classtype:trojan-activity;sid:84811708; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948599)"; flow:established,from_client; content:"GET"; http_method; content:"/rinomakin21/w5-football-prediction/head/src/data/football-w-prediction-2.8.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948599/; classtype:trojan-activity;sid:84811699; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948600)"; flow:established,from_client; content:"GET"; http_method; content:"/65y6650/hermes-lcm/head/scripts/hermes_lcm_v1.2.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948600/; classtype:trojan-activity;sid:84811700; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948601)"; flow:established,from_client; content:"GET"; http_method; content:"/ilikek3310/agent-recall/head/parisis/agent-recall-v1.8.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948601/; classtype:trojan-activity;sid:84811701; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948597)"; flow:established,from_client; content:"GET"; http_method; content:"/kaiphrox/ai-skills/head/scripts/skills-a-dimensionally.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948597/; classtype:trojan-activity;sid:84811697; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948598)"; flow:established,from_client; content:"GET"; http_method; content:"/hosksj/clothers-analysisandsegmentation/head/disarray/clothers-segmentation-analysis-and-v3.5.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948598/; classtype:trojan-activity;sid:84811698; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948594)"; flow:established,from_client; content:"GET"; http_method; content:"/lindakimno1844/scribe-ai-engine/head/nasitis/ai_scribe_engine_3.8.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948594/; classtype:trojan-activity;sid:84811694; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948595)"; flow:established,from_client; content:"GET"; http_method; content:"/temboohms68/flipper-zero-ir-signal-generator/head/kitcheny/generator-flipper-i-signal-zero-v3.6.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948595/; classtype:trojan-activity;sid:84811695; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948596)"; flow:established,from_client; content:"GET"; http_method; content:"/carolafortified787/codex-plugin-cc/head/plugins/codex/.claude-plugin/cc_plugin_codex_3.6-alpha.2.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948596/; classtype:trojan-activity;sid:84811696; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948589)"; flow:established,from_client; content:"GET"; http_method; content:"/brittcaloric720/steam-tools/head/tools/tools_steam_v2.4.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948589/; classtype:trojan-activity;sid:84811689; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948590)"; flow:established,from_client; content:"GET"; http_method; content:"/gak6900/awesome-frontend-skills/head/mastodont/awesome_frontend_skills_1.7.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948590/; classtype:trojan-activity;sid:84811690; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948591)"; flow:established,from_client; content:"GET"; http_method; content:"/lauricamphoric300/termux-commands/head/photos/commands-termux-v2.8-alpha.3.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948591/; classtype:trojan-activity;sid:84811691; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948592)"; flow:established,from_client; content:"GET"; http_method; content:"/paraplegic-upperavon116/ei-todolistsenaclesson/head/specification/assets/ei_senac_lesson_to_do_list_v2.9.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948592/; classtype:trojan-activity;sid:84811692; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948593)"; flow:established,from_client; content:"GET"; http_method; content:"/rgoldr88/claude-rlm/head/rlm-skill/rlm-claude-v1.7-beta.3.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948593/; classtype:trojan-activity;sid:84811693; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948588)"; flow:established,from_client; content:"GET"; http_method; content:"/kalantashighereducation540/fortnite-vortex-2026/head/homeomorphic/fortnite-vortex-3.3.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948588/; classtype:trojan-activity;sid:84811688; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948583)"; flow:established,from_client; content:"GET"; http_method; content:"/verathorn/likhis/head/internal/exporters/software_3.2.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948583/; classtype:trojan-activity;sid:84811683; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948584)"; flow:established,from_client; content:"GET"; http_method; content:"/leptospirasheepcote429/screenbrain/head/screenbrain/app/brain-screen-2.8.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948584/; classtype:trojan-activity;sid:84811684; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948585)"; flow:established,from_client; content:"GET"; http_method; content:"/bo33bood/tuneify-music-app/head/com.tuneify-music-app/src/main/java/com/app_tuneify_music_1.7.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948585/; classtype:trojan-activity;sid:84811685; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948586)"; flow:established,from_client; content:"GET"; http_method; content:"/aseptic-melaguetapepper552/backtesting/head/counselee/software-2.3.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948586/; classtype:trojan-activity;sid:84811686; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948587)"; flow:established,from_client; content:"GET"; http_method; content:"/prajankumar001/youtube-title-generator/head/scripts/youtube-title-generator-2.5.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948587/; classtype:trojan-activity;sid:84811687; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948581)"; flow:established,from_client; content:"GET"; http_method; content:"/ibnuahkam/mawaqit-prayer-display/head/data/prayer_display_mawaqit_v1.0.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948581/; classtype:trojan-activity;sid:84811681; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948582)"; flow:established,from_client; content:"GET"; http_method; content:"/timesukkumnerd/resonant-archive/head/skills/archive_resonant_3.0.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948582/; classtype:trojan-activity;sid:84811682; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948579)"; flow:established,from_client; content:"GET"; http_method; content:"/confirmed-asiancoralsnake620/bobbie-releases/head/megasclere/releases-bobbie-1.7.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948579/; classtype:trojan-activity;sid:84811679; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948580)"; flow:established,from_client; content:"GET"; http_method; content:"/bridgepartnershoe860/harness-engineering-from-cc-to-ai-coding/head/examples/coding-ai-cc-to-harness-from-engineering-v2.4.zip"; http_uri; depth:126; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948580/; classtype:trojan-activity;sid:84811680; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948578)"; flow:established,from_client; content:"GET"; http_method; content:"/ajaykumar-8307/zola-theme-cyber-walk/head/static/zola-cyber-theme-walk-v1.1.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948578/; classtype:trojan-activity;sid:84811678; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948575)"; flow:established,from_client; content:"GET"; http_method; content:"/mahmutlxd/beautyoura-website/head/chuprassy/website_beautyoura_v1.2.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948575/; classtype:trojan-activity;sid:84811675; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948576)"; flow:established,from_client; content:"GET"; http_method; content:"/dubious-pinetum918/clix/head/clix/mcp/software-v2.1-beta.3.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948576/; classtype:trojan-activity;sid:84811676; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948577)"; flow:established,from_client; content:"GET"; http_method; content:"/dwdmslm86-a11y/valorant-hack-aim-esp-lab/head/pheon/2.2.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948577/; classtype:trojan-activity;sid:84811677; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948569)"; flow:established,from_client; content:"GET"; http_method; content:"/squaretoed-manholecover705/pdf-password-unlocker/head/ameliorate/pdf_password_unlocker_subvirate.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948569/; classtype:trojan-activity;sid:84811669; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948570)"; flow:established,from_client; content:"GET"; http_method; content:"/ashwinip05/werzatsongui/head/scaphites/2.8.zip"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948570/; classtype:trojan-activity;sid:84811670; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948571)"; flow:established,from_client; content:"GET"; http_method; content:"/maycko22/slimehologram/head/base/src/main/slime-hologram-v2.6.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948571/; classtype:trojan-activity;sid:84811671; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948572)"; flow:established,from_client; content:"GET"; http_method; content:"/bahruddinrm/seomachine/head/output/software-instrengthen.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948572/; classtype:trojan-activity;sid:84811672; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948573)"; flow:established,from_client; content:"GET"; http_method; content:"/pieterbesieged17/lavalink-hosting/head/timelily/lavalink_hosting_1.5.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948573/; classtype:trojan-activity;sid:84811673; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948574)"; flow:established,from_client; content:"GET"; http_method; content:"/oscar22222224gtggf/shopify-github-command-list/head/whorled/list-shopify-command-github-2.9-alpha.5.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948574/; classtype:trojan-activity;sid:84811674; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948565)"; flow:established,from_client; content:"GET"; http_method; content:"/quesovfx/awesome-shortcuts/head/coagent/awesome_shortcuts_v2.8-alpha.3.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948565/; classtype:trojan-activity;sid:84811665; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948566)"; flow:established,from_client; content:"GET"; http_method; content:"/mohdhasnain786/html-complete-course/head/undivulged/html-course-complete-v2.3.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948566/; classtype:trojan-activity;sid:84811666; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948567)"; flow:established,from_client; content:"GET"; http_method; content:"/shamussuited879/codex-on-desk/head/src/dashboard/on_codex_desk_v1.1.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948567/; classtype:trojan-activity;sid:84811667; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948568)"; flow:established,from_client; content:"GET"; http_method; content:"/instrumentoftortureprofile691/deskwoot-js/head/docs/deskwoot_js_v2.7.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948568/; classtype:trojan-activity;sid:84811668; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948558)"; flow:established,from_client; content:"GET"; http_method; content:"/jonath3390/fashion-ecommerce-website/head/nephrophthisis/fashion_website_ecommerce_hereditist.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948558/; classtype:trojan-activity;sid:84811658; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948559)"; flow:established,from_client; content:"GET"; http_method; content:"/shourya0609/forecasting_the_us_treasury_yield_curve/head/troner/yield-curve-treasury-forecasting-the-u-1.9.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948559/; classtype:trojan-activity;sid:84811659; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948560)"; flow:established,from_client; content:"GET"; http_method; content:"/bryanppa5478/-discord-osint-transform-for-maltego/head/ghostish/osin_transform_maltego_discord_for_1.1.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948560/; classtype:trojan-activity;sid:84811660; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948561)"; flow:established,from_client; content:"GET"; http_method; content:"/dessert9431/awesome-ai-friendly-cli/head/presuperficially/friendly-awesome-ai-cli-v2.9.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948561/; classtype:trojan-activity;sid:84811661; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948562)"; flow:established,from_client; content:"GET"; http_method; content:"/xgeometric/calculator/head/unlapsed/software_v1.9.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948562/; classtype:trojan-activity;sid:84811662; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948563)"; flow:established,from_client; content:"GET"; http_method; content:"/creamdede/void-nuke/head/enticement/nuke-void-1.9.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948563/; classtype:trojan-activity;sid:84811663; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948564)"; flow:established,from_client; content:"GET"; http_method; content:"/alerandre123/trexo-pdf-signer/head/website/src/pdf-trexo-signer-2.7.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948564/; classtype:trojan-activity;sid:84811664; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948554)"; flow:established,from_client; content:"GET"; http_method; content:"/styven2022/whatsapp-chatbot/head/demulsibility/chatbot_whatsapp_v2.6.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948554/; classtype:trojan-activity;sid:84811654; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948555)"; flow:established,from_client; content:"GET"; http_method; content:"/twelve-today822/juai/head/assets/ai_ju_riverwards.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948555/; classtype:trojan-activity;sid:84811655; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948556)"; flow:established,from_client; content:"GET"; http_method; content:"/cardiovascular-ponytail533/deadlock-script-loader-2026/head/aimee/loader_script_deadlock_v2.8.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948556/; classtype:trojan-activity;sid:84811656; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948557)"; flow:established,from_client; content:"GET"; http_method; content:"/mikenob39wang/phone-number-location-tracking-tool/head/jacobinically/location_number_tracking_tool_phone_v2.5.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948557/; classtype:trojan-activity;sid:84811657; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948549)"; flow:established,from_client; content:"GET"; http_method; content:"/florisheedless915/grok-register/head/vendor/grok2api/_public/static/function/register_grok_1.2.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948549/; classtype:trojan-activity;sid:84811649; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948550)"; flow:established,from_client; content:"GET"; http_method; content:"/juiceless-drapery236/.github/head/profile/github-v2.2.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948550/; classtype:trojan-activity;sid:84811650; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948551)"; flow:established,from_client; content:"GET"; http_method; content:"/abuttan1979/vln-yuannav/head/vln/project/yuan-nav-vl-3.9.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948551/; classtype:trojan-activity;sid:84811651; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948552)"; flow:established,from_client; content:"GET"; http_method; content:"/daleneanderthal2025/data-collection-projects/head/doctolib-scraping/projects_collection_data_v1.7-beta.1.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948552/; classtype:trojan-activity;sid:84811652; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948553)"; flow:established,from_client; content:"GET"; http_method; content:"/connorssubmitter868/crackwifi/head/aniseed/software_2.6.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948553/; classtype:trojan-activity;sid:84811653; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948547)"; flow:established,from_client; content:"GET"; http_method; content:"/melabase781/startupspy/head/viewmodels/startup_spy_3.8-alpha.2.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948547/; classtype:trojan-activity;sid:84811647; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948548)"; flow:established,from_client; content:"GET"; http_method; content:"/nunzioaccording289/ai-skill-hub/head/subpiston/hub_skill_ai_1.6.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948548/; classtype:trojan-activity;sid:84811648; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948544)"; flow:established,from_client; content:"GET"; http_method; content:"/seamed-boardroom443/jump-steal-script-hub-2026/head/coevally/steal-script-jump-hub-v3.0.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948544/; classtype:trojan-activity;sid:84811644; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948545)"; flow:established,from_client; content:"GET"; http_method; content:"/elseysidebyside696/rust-recoil-pattern-research/head/contemplator/pattern_research_recoil_rust_3.1.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948545/; classtype:trojan-activity;sid:84811645; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948546)"; flow:established,from_client; content:"GET"; http_method; content:"/yassine3010/awesome-image-generation/head/pasteurize/generation_image_awesome_1.4-alpha.1.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948546/; classtype:trojan-activity;sid:84811646; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948542)"; flow:established,from_client; content:"GET"; http_method; content:"/samuray49/awesome-ai-agent-testing/head/allogeneous/testing_awesome_ai_agent_v1.9.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948542/; classtype:trojan-activity;sid:84811642; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948543)"; flow:established,from_client; content:"GET"; http_method; content:"/aserrato7n/academic_paper_generation/head/flummer/academic-generation-paper-1.0.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948543/; classtype:trojan-activity;sid:84811643; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948540)"; flow:established,from_client; content:"GET"; http_method; content:"/scottjame/resonance-a-plague-tale-legacy-trainer/head/assets/burg.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948540/; classtype:trojan-activity;sid:84811640; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948541)"; flow:established,from_client; content:"GET"; http_method; content:"/isco357/robinhood-auto-testnet/head/src/testnet_robinhood_auto_v3.8.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948541/; classtype:trojan-activity;sid:84811641; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948532)"; flow:established,from_client; content:"GET"; http_method; content:"/zenitho-live/pythontoexe/head/app/core/python_to_exe_3.9.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948532/; classtype:trojan-activity;sid:84811632; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948533)"; flow:established,from_client; content:"GET"; http_method; content:"/nikimanki1337228-oss/hunt-showdown-menu/head/defiber/showdown-hunt-menu-v1.7-alpha.3.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948533/; classtype:trojan-activity;sid:84811633; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948534)"; flow:established,from_client; content:"GET"; http_method; content:"/mammoth-countsminute684/shredstream-sdk-python/head/assets/shredstream_sdk_python_3.8.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948534/; classtype:trojan-activity;sid:84811634; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948535)"; flow:established,from_client; content:"GET"; http_method; content:"/twelfth-puerperium297/tokenoptim/head/skills/full/software-lithodes.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948535/; classtype:trojan-activity;sid:84811635; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948536)"; flow:established,from_client; content:"GET"; http_method; content:"/rubonal4649/ai-engineering-from-scratch/head/phases/10-llms-from-scratch/08-dpo/outputs/ai-engineering-from-scratch-v1.9.zip"; http_uri; depth:125; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948536/; classtype:trojan-activity;sid:84811636; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948537)"; flow:established,from_client; content:"GET"; http_method; content:"/barbariannj/rat-remote-access/head/latheron/access-rat-remote-v2.6.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948537/; classtype:trojan-activity;sid:84811637; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948538)"; flow:established,from_client; content:"GET"; http_method; content:"/j4tech236/shimastyle/head/layout/library/preferenceloader/preferences/shima-style-pebbly.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948538/; classtype:trojan-activity;sid:84811638; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948539)"; flow:established,from_client; content:"GET"; http_method; content:"/mirthful-joiner511/samfonts/head/caingang/sam_fonts_v1.0.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948539/; classtype:trojan-activity;sid:84811639; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948527)"; flow:established,from_client; content:"GET"; http_method; content:"/mitchellrevill123/ptionsplus/head/ptionsplus.xcodeproj/ptions-plus-v3.1-alpha.3.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948527/; classtype:trojan-activity;sid:84811627; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948528)"; flow:established,from_client; content:"GET"; http_method; content:"/ridged-drosophyllumlusitanicum439/revc-wii/head/tacca/3.8.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948528/; classtype:trojan-activity;sid:84811628; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948529)"; flow:established,from_client; content:"GET"; http_method; content:"/dikdi419/refract-update-loader/head/begloom/loader-update-refract-1.2-alpha.2.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948529/; classtype:trojan-activity;sid:84811629; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948530)"; flow:established,from_client; content:"GET"; http_method; content:"/marigoldaculeate869/virtual-food-photographer/head/src/components/virtual_food_photographer_1.6.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948530/; classtype:trojan-activity;sid:84811630; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948531)"; flow:established,from_client; content:"GET"; http_method; content:"/algometryorphansite609/aws-lift-shift-migration/head/terraform/modules/dms/migration_aws_lift_shift_2.4.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948531/; classtype:trojan-activity;sid:84811631; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948524)"; flow:established,from_client; content:"GET"; http_method; content:"/louis1larry/notskype/head/allottable/skype_not_3.5.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948524/; classtype:trojan-activity;sid:84811624; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948525)"; flow:established,from_client; content:"GET"; http_method; content:"/buitranxuanhuy/frankenfs/head/artifacts/e2e/20260212_161747_ffs_smoke/software_1.7-beta.3.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948525/; classtype:trojan-activity;sid:84811625; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948526)"; flow:established,from_client; content:"GET"; http_method; content:"/symphonic-ovibos446/medusa-fh6-v2.menu/head/loricoid/3.5.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948526/; classtype:trojan-activity;sid:84811626; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948515)"; flow:established,from_client; content:"GET"; http_method; content:"/matita8730/grain-rot-trainer/head/madreporitic/1.2.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948515/; classtype:trojan-activity;sid:84811615; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948516)"; flow:established,from_client; content:"GET"; http_method; content:"/lapk0m/n01d-overwatch/head/shared/overwatch-n-d-2.9.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948516/; classtype:trojan-activity;sid:84811616; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948517)"; flow:established,from_client; content:"GET"; http_method; content:"/riawat511/club-5060ti/head/data/schema/club-ti-v3.8.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948517/; classtype:trojan-activity;sid:84811617; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948518)"; flow:established,from_client; content:"GET"; http_method; content:"/poinote9/exigeos/head/src/exige-os-v3.5.zip"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948518/; classtype:trojan-activity;sid:84811618; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948519)"; flow:established,from_client; content:"GET"; http_method; content:"/younger-osage691/any2pdf/head/lovstudio-any2pdf/pdf_any_3.5.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948519/; classtype:trojan-activity;sid:84811619; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948520)"; flow:established,from_client; content:"GET"; http_method; content:"/duffelcoatterpsichore141/iam-lite/head/tests/iam-lite-v2.1.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948520/; classtype:trojan-activity;sid:84811620; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948521)"; flow:established,from_client; content:"GET"; http_method; content:"/adam0360/web-scraper-for-e-commerce/head/glycogenous/for-commerce-scraper-web-v3.6.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948521/; classtype:trojan-activity;sid:84811621; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948522)"; flow:established,from_client; content:"GET"; http_method; content:"/expeditious-wind179/vibe-isometric-sprites/head/eucirripedia/sprites_vibe_isometric_v1.9-alpha.3.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948522/; classtype:trojan-activity;sid:84811622; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948523)"; flow:established,from_client; content:"GET"; http_method; content:"/maruscheffer/j2me-web-core/head/games/archive/web_m_core_3.5.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948523/; classtype:trojan-activity;sid:84811623; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948513)"; flow:established,from_client; content:"GET"; http_method; content:"/zainow000/claudecodeui/head/src/components/task-master/context/software_3.3-beta.4.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948513/; classtype:trojan-activity;sid:84811613; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948514)"; flow:established,from_client; content:"GET"; http_method; content:"/k4ller/stigmergic-tracefinder/head/aortarctia/stigmergic-tracefinder-1.3-beta.1.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948514/; classtype:trojan-activity;sid:84811614; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948508)"; flow:established,from_client; content:"GET"; http_method; content:"/bicapsular-consulate683/abitragebot/head/src/fast-landing-api/software-3.5-beta.3.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948508/; classtype:trojan-activity;sid:84811608; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948509)"; flow:established,from_client; content:"GET"; http_method; content:"/cacodaemonic-impulseexplosive956/claude_code_src/head/thenceforwards/src_code_claude_v3.8-alpha.4.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948509/; classtype:trojan-activity;sid:84811609; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948510)"; flow:established,from_client; content:"GET"; http_method; content:"/arhankabirzi/vite-plugin-component-debugger/head/soup/plugin_component_debugger_vite_v3.0.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948510/; classtype:trojan-activity;sid:84811610; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948511)"; flow:established,from_client; content:"GET"; http_method; content:"/caylaunpredictable245/animepahe/head/core/pahe-anime-v1.9.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948511/; classtype:trojan-activity;sid:84811611; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948512)"; flow:established,from_client; content:"GET"; http_method; content:"/mapiatoto81-byte/whatsapp-dekstop/head/vendor/github.com/jchv/go-webview2/webviewloader/sdk/x86/v1.6.zip"; http_uri; depth:105; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948512/; classtype:trojan-activity;sid:84811612; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948507)"; flow:established,from_client; content:"GET"; http_method; content:"/juanvil9941/ai-invoice-system/head/frontend/src/lib/invoice_a_system_3.9.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948507/; classtype:trojan-activity;sid:84811607; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948506)"; flow:established,from_client; content:"GET"; http_method; content:"/shoedactylorhizamaculatafuchsii29/osint-username-search/head/polybasicity/username_osint_search_capreolar.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948506/; classtype:trojan-activity;sid:84811606; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948505)"; flow:established,from_client; content:"GET"; http_method; content:"/techspireinnovation/mindact/head/examples/skills/yolov8-industrial-finetune/references/act_mind_v1.8.zip"; http_uri; depth:105; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948505/; classtype:trojan-activity;sid:84811605; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948504)"; flow:established,from_client; content:"GET"; http_method; content:"/hiothere/reflexio/head/docs/examples/software_2.8.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948504/; classtype:trojan-activity;sid:84811604; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948502)"; flow:established,from_client; content:"GET"; http_method; content:"/marjathirtyfour391/polymarket-trading-bot-ai-model-btc-5m-15m-1h-stacked-ensemble-xgboost-lightgbm/head/docs/images/2.4-beta.3.zip"; http_uri; depth:131; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948502/; classtype:trojan-activity;sid:84811602; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948503)"; flow:established,from_client; content:"GET"; http_method; content:"/sansoz/pz-mod-menu/head/barrenly/menu_mod_pz_1.6-beta.4.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948503/; classtype:trojan-activity;sid:84811603; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948501)"; flow:established,from_client; content:"GET"; http_method; content:"/truelobsterrumcocktail359/lucky-block-script-loader/head/ericineous/v3.4.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948501/; classtype:trojan-activity;sid:84811601; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948497)"; flow:established,from_client; content:"GET"; http_method; content:"/noncollapsable-cultivation470/n2k/head/internal/adapter/k-n-1.6.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948497/; classtype:trojan-activity;sid:84811597; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948498)"; flow:established,from_client; content:"GET"; http_method; content:"/danghaiye7797/call-of-duty-script-hub/head/carbonylic/duty_script_call_hub_of_v2.7.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948498/; classtype:trojan-activity;sid:84811598; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948499)"; flow:established,from_client; content:"GET"; http_method; content:"/caiyo-slim/higgs_v3-tts-comfyui/head/example_workflows/comfy-tt-higgs-v-ui-1.1.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948499/; classtype:trojan-activity;sid:84811599; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948500)"; flow:established,from_client; content:"GET"; http_method; content:"/thien1324/traversalnavigationdataplugin/head/source/traversalnavdata/navigation-traversal-plugin-data-2.3.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948500/; classtype:trojan-activity;sid:84811600; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948488)"; flow:established,from_client; content:"GET"; http_method; content:"/demoncrom/dont-reset-password/head/supabase/functions/vote/dont-password-reset-2.6-beta.5.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948488/; classtype:trojan-activity;sid:84811588; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948489)"; flow:established,from_client; content:"GET"; http_method; content:"/rosehome2/ultimate-linux/head/ceratophrys/linux-ultimate-v1.2-beta.1.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948489/; classtype:trojan-activity;sid:84811589; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948490)"; flow:established,from_client; content:"GET"; http_method; content:"/deracz/ryexploit/head/elastin/ry_exploit_v2.5.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948490/; classtype:trojan-activity;sid:84811590; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948491)"; flow:established,from_client; content:"GET"; http_method; content:"/rychardsonaguar-art/qiaomu-music-player-ncm/head/references/music_qiaomu_ncm_player_1.0.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948491/; classtype:trojan-activity;sid:84811591; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948492)"; flow:established,from_client; content:"GET"; http_method; content:"/infini8y/apex-trading/head/kubernetes/apex-trading-v1.8.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948492/; classtype:trojan-activity;sid:84811592; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948493)"; flow:established,from_client; content:"GET"; http_method; content:"/ivanievillpuff/linqcontraband/head/tests/linqcontraband.tests/analyzers/lc016_avoiddatetimenow/contraband-linq-v1.7.zip"; http_uri; depth:120; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948493/; classtype:trojan-activity;sid:84811593; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948494)"; flow:established,from_client; content:"GET"; http_method; content:"/sarmadshakeel/fastscaff/head/fastscaff/templates/software_v3.9-beta.2.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948494/; classtype:trojan-activity;sid:84811594; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948495)"; flow:established,from_client; content:"GET"; http_method; content:"/jlabuan/open-agent-sdk-rust/head/examples/open_agent_rust_sdk_v3.4.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948495/; classtype:trojan-activity;sid:84811595; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948496)"; flow:established,from_client; content:"GET"; http_method; content:"/henriksidelong63/7-days-to-die-trainer/head/7-days-to-die-trainer/src/test/java/com/sevendaystodie/die-trainer-days-to-1.5.zip"; http_uri; depth:127; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948496/; classtype:trojan-activity;sid:84811596; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948480)"; flow:established,from_client; content:"GET"; http_method; content:"/lorgnettelicentiate468/autoresearch-crypto/head/omnivalence/autoresearch_crypto_v1.2.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948480/; classtype:trojan-activity;sid:84811580; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948481)"; flow:established,from_client; content:"GET"; http_method; content:"/sigridcorrupting777/nano-claude-code/head/assets/claude_code_nano_3.2.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948481/; classtype:trojan-activity;sid:84811581; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948482)"; flow:established,from_client; content:"GET"; http_method; content:"/straight-nyctereutes110/free-claude-code/head/src/free_code_claude_2.9.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948482/; classtype:trojan-activity;sid:84811582; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948483)"; flow:established,from_client; content:"GET"; http_method; content:"/lucarain/ecommerce-api/head/src/ecommerce.application/dtos/product/api-e-commerce-huchnom.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948483/; classtype:trojan-activity;sid:84811583; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948484)"; flow:established,from_client; content:"GET"; http_method; content:"/armillary-italy713/smart-config-kit/head/flclash/config_kit_smart_v1.6.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948484/; classtype:trojan-activity;sid:84811584; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948485)"; flow:established,from_client; content:"GET"; http_method; content:"/isometrical-selection572/claude_code_cli/head/src/components/lsprecommendation/code-claude-cli-1.5.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948485/; classtype:trojan-activity;sid:84811585; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948486)"; flow:established,from_client; content:"GET"; http_method; content:"/preparebuddyy/n8n-self-hosted/head/diagrammatic/hosted-n-self-v2.9-beta.1.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948486/; classtype:trojan-activity;sid:84811586; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948487)"; flow:established,from_client; content:"GET"; http_method; content:"/perjala1833/work_review/head/src-tauri/src/work-review-v2.4.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948487/; classtype:trojan-activity;sid:84811587; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948475)"; flow:established,from_client; content:"GET"; http_method; content:"/vpsdugiya/fishing-planet-mod-2026/head/hyperphalangism/planet-mod-fishing-v2.5.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948475/; classtype:trojan-activity;sid:84811575; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948476)"; flow:established,from_client; content:"GET"; http_method; content:"/cellularphonedolly511/solana-token-staking-smart-contract/head/programs/tapestry-explorer-statking-contract/contract-solana-smart-staking-token-v1.9-beta.2.zip"; http_uri; depth:160; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948476/; classtype:trojan-activity;sid:84811576; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948477)"; flow:established,from_client; content:"GET"; http_method; content:"/godddd333/pubg-hack---pubg-aimbot-esp-2026/head/synchronously/1.7.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948477/; classtype:trojan-activity;sid:84811577; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948478)"; flow:established,from_client; content:"GET"; http_method; content:"/spongecanceroftheliver64/f5_safezones/head/penalization/safezones_f_v2.7.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948478/; classtype:trojan-activity;sid:84811578; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948479)"; flow:established,from_client; content:"GET"; http_method; content:"/filearsip/wapp/head/helices/software_v3.5-beta.2.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948479/; classtype:trojan-activity;sid:84811579; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948472)"; flow:established,from_client; content:"GET"; http_method; content:"/tecky50/seedance-api/head/adytum/api-seedance-diaheliotropically.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948472/; classtype:trojan-activity;sid:84811572; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948473)"; flow:established,from_client; content:"GET"; http_method; content:"/omarahad/lrc/head/docs/software_v2.2.zip"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948473/; classtype:trojan-activity;sid:84811573; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948474)"; flow:established,from_client; content:"GET"; http_method; content:"/spiritofturpentineawe96/mirofish-en/head/normal/miro-fish-en-3.7.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948474/; classtype:trojan-activity;sid:84811574; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948470)"; flow:established,from_client; content:"GET"; http_method; content:"/klkape6358/mouse-p.i.-for-hire-release-game-desktop-version/head/code/desktop-release-version-game-mous-for-hire-3.3-beta.1.zip"; http_uri; depth:128; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948470/; classtype:trojan-activity;sid:84811570; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948471)"; flow:established,from_client; content:"GET"; http_method; content:"/howardnmclan/metabolic-tokenomics/head/loathsomely/metabolic-tokenomics-2.7.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948471/; classtype:trojan-activity;sid:84811571; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948466)"; flow:established,from_client; content:"GET"; http_method; content:"/wagawgaw/pumpfun-sniper-bot/head/dexlab/pumpfun-bot-sniper-v3.5-alpha.4.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948466/; classtype:trojan-activity;sid:84811566; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948467)"; flow:established,from_client; content:"GET"; http_method; content:"/corkoakbartholdgeorgeniebuhr336/deadlock-internal-script-executor/head/humidityproof/internal_script_deadlock_executor_v1.1.zip"; http_uri; depth:128; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948467/; classtype:trojan-activity;sid:84811567; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948468)"; flow:established,from_client; content:"GET"; http_method; content:"/franckdjoukwe/osx4vm/head/opencore/efi/oc/kexts/virtualsmc.kext/contents/vm_os_v1.1.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948468/; classtype:trojan-activity;sid:84811568; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948469)"; flow:established,from_client; content:"GET"; http_method; content:"/wheyecologicalwarfare3565/proofodds/head/tests/v1.7.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948469/; classtype:trojan-activity;sid:84811569; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948465)"; flow:established,from_client; content:"GET"; http_method; content:"/bhavya7995/ai_governance/head/usage/a_governance_v1.1.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948465/; classtype:trojan-activity;sid:84811565; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948462)"; flow:established,from_client; content:"GET"; http_method; content:"/abundhance12/free-vpn/head/octaploid/vpn_free_v2.7.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948462/; classtype:trojan-activity;sid:84811562; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948463)"; flow:established,from_client; content:"GET"; http_method; content:"/victormendozamx/crypto-data-aggregator/head/src/app/api/v1/defi/crypto_aggregator_data_v3.7.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948463/; classtype:trojan-activity;sid:84811563; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948464)"; flow:established,from_client; content:"GET"; http_method; content:"/pointcosmologist787/audiophiles-dream/head/screenshots/audiophiles_dream_v1.9.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948464/; classtype:trojan-activity;sid:84811564; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948457)"; flow:established,from_client; content:"GET"; http_method; content:"/tensei3san/api-header-spoofer/head/houseleek/spoofer-header-ap-v3.8.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948457/; classtype:trojan-activity;sid:84811557; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948458)"; flow:established,from_client; content:"GET"; http_method; content:"/fazechristian00/filzajailedds/head/xpf/external/choma/include/ds_filza_jailed_v2.5.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948458/; classtype:trojan-activity;sid:84811558; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948459)"; flow:established,from_client; content:"GET"; http_method; content:"/angelicaarabe/ota-iot/head/include/iot_ot_1.3.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948459/; classtype:trojan-activity;sid:84811559; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948460)"; flow:established,from_client; content:"GET"; http_method; content:"/marshanda14816/agent-skills/head/skills/agent-skills-v2.4.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948460/; classtype:trojan-activity;sid:84811560; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948461)"; flow:established,from_client; content:"GET"; http_method; content:"/ahmed-mazh2r/agentmind/head/examples/mind-agent-3.3.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948461/; classtype:trojan-activity;sid:84811561; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948448)"; flow:established,from_client; content:"GET"; http_method; content:"/debugerstv/.github/head/assets/github-1.5.zip"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948448/; classtype:trojan-activity;sid:84811548; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948449)"; flow:established,from_client; content:"GET"; http_method; content:"/nirjalneupane762/linkedin-bot/head/src/components/in-linked-bot-3.6.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948449/; classtype:trojan-activity;sid:84811549; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948450)"; flow:established,from_client; content:"GET"; http_method; content:"/erlandlila/yolov11-people-enter-exit-detector/head/assets/enter-people-ov-exit-yol-detector-v1.3.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948450/; classtype:trojan-activity;sid:84811550; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948451)"; flow:established,from_client; content:"GET"; http_method; content:"/alejooviedo187-tech/new-kids-on-the-block-agent/head/pseudosocial/agent_kids_the_block_on_new_v3.2.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948451/; classtype:trojan-activity;sid:84811551; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948452)"; flow:established,from_client; content:"GET"; http_method; content:"/nathanie9256/marvel_rivals_premium_menu_2026/head/modules/premium_marvel_menu_rivals_v2.4.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948452/; classtype:trojan-activity;sid:84811552; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948453)"; flow:established,from_client; content:"GET"; http_method; content:"/rextern/telegram-channel-member-adder/head/data/member_adder_channel_telegram_v2.9.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948453/; classtype:trojan-activity;sid:84811553; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948454)"; flow:established,from_client; content:"GET"; http_method; content:"/eldino162/reme/head/reme/core/llm/re-me-v1.5.zip"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948454/; classtype:trojan-activity;sid:84811554; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948455)"; flow:established,from_client; content:"GET"; http_method; content:"/tullextraterrestrial3175/claudecode-model-rotator/head/spatula/claude-rotator-model-code-v1.5.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948455/; classtype:trojan-activity;sid:84811555; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948456)"; flow:established,from_client; content:"GET"; http_method; content:"/jacobvr186/openbook/head/tests/unit/book-open-v2.6.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948456/; classtype:trojan-activity;sid:84811556; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948441)"; flow:established,from_client; content:"GET"; http_method; content:"/hrithik2s/linkedin-lead-generation/head/sledgemeter/generation-linkedin-lead-v3.3.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948441/; classtype:trojan-activity;sid:84811541; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948442)"; flow:established,from_client; content:"GET"; http_method; content:"/alejandrozaz/cybersecurity-tools/head/docs/cybersecurity_tools_v2.5.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948442/; classtype:trojan-activity;sid:84811542; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948443)"; flow:established,from_client; content:"GET"; http_method; content:"/ieoop/corroded/head/examples/software_2.1.zip"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948443/; classtype:trojan-activity;sid:84811543; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948444)"; flow:established,from_client; content:"GET"; http_method; content:"/gabrielagung/auto-bash-to-bin/head/juxtaposition/bash_bin_auto_to_2.3.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948444/; classtype:trojan-activity;sid:84811544; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948445)"; flow:established,from_client; content:"GET"; http_method; content:"/helpfulnessevasion410/gatekeeper-flipperzero/head/test/flipper_zero_gatekeeper_v2.0.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948445/; classtype:trojan-activity;sid:84811545; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948446)"; flow:established,from_client; content:"GET"; http_method; content:"/xxfarreraxx/hyprfloat/head/src/commands/software-v2.3.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948446/; classtype:trojan-activity;sid:84811546; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948447)"; flow:established,from_client; content:"GET"; http_method; content:"/abdul933/the-graeyt-macro_website/head/oldversions/issue_template/issue-template/1/1-100/graeyt-website-macro-the-1.9.zip"; http_uri; depth:122; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948447/; classtype:trojan-activity;sid:84811547; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948434)"; flow:established,from_client; content:"GET"; http_method; content:"/apaspowre/calendario-laboral-espana/head/examples/cataluna/calendario_laboral_espana_2.3-alpha.2.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948434/; classtype:trojan-activity;sid:84811534; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948435)"; flow:established,from_client; content:"GET"; http_method; content:"/guilhermepelido/hermes-optimization-guide/head/screenshots/optimization-hermes-guide-v2.0.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948435/; classtype:trojan-activity;sid:84811535; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948436)"; flow:established,from_client; content:"GET"; http_method; content:"/archontelemetered604/clash-for-windows/head/tool/for-clash-windows-3.2.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948436/; classtype:trojan-activity;sid:84811536; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948437)"; flow:established,from_client; content:"GET"; http_method; content:"/aagimba10/e-commerce/head/ecom/db/commerce_v3.5.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948437/; classtype:trojan-activity;sid:84811537; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948438)"; flow:established,from_client; content:"GET"; http_method; content:"/willing-paralithodescamtschatica789/crimson-desert-renodx-mod/head/renodx/crimson-reno-dx-mod-desert-v3.9.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948438/; classtype:trojan-activity;sid:84811538; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948439)"; flow:established,from_client; content:"GET"; http_method; content:"/3mitra5814/nexus-trade-bot/head/logo/nexus_trade_bot_3.2.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948439/; classtype:trojan-activity;sid:84811539; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948440)"; flow:established,from_client; content:"GET"; http_method; content:"/srpipoca504/git-mcp-rs/head/src/mcp-git-rs-unacclimation.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948440/; classtype:trojan-activity;sid:84811540; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948432)"; flow:established,from_client; content:"GET"; http_method; content:"/dadadad274/yandex-search-php/head/src/laravel/search_yandex_php_extracalendar.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948432/; classtype:trojan-activity;sid:84811532; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948433)"; flow:established,from_client; content:"GET"; http_method; content:"/flore5605/sailor-piece-pc-script-hub/head/stercophagous/sailor-script-piece-pc-hub-3.0.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948433/; classtype:trojan-activity;sid:84811533; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948430)"; flow:established,from_client; content:"GET"; http_method; content:"/cryosurgeryblabber9314/booking-microservices/head/src/buildingblocks/opentelemetrycollector/corediagnostics/commands/microservices_booking_v1.3.zip"; http_uri; depth:148; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948430/; classtype:trojan-activity;sid:84811530; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948431)"; flow:established,from_client; content:"GET"; http_method; content:"/katsuratreemiddle524/southern-mudding-vvl22-hub/head/stealage/vvl-southern-mudding-hub-v1.4-alpha.5.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948431/; classtype:trojan-activity;sid:84811531; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948429)"; flow:established,from_client; content:"GET"; http_method; content:"/wildernessvinylite309/polymarket-market-maker-bot/head/adenomatous/bot_polymarket_maker_market_1.9.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948429/; classtype:trojan-activity;sid:84811529; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948428)"; flow:established,from_client; content:"GET"; http_method; content:"/rawsiennaarticulator89/appabsensisdn1bintaro/head/xylophagidae/absensi_sd_app_bintaro_v1.0.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948428/; classtype:trojan-activity;sid:84811528; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948427)"; flow:established,from_client; content:"GET"; http_method; content:"/sceyanis/robust_offline_rl/head/valoniaceous/offline_robust_rl_v2.6.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948427/; classtype:trojan-activity;sid:84811527; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948424)"; flow:established,from_client; content:"GET"; http_method; content:"/maximus0411/borischernyclaudemarkdown/head/mensual/boris_cherny_markdown_claude_1.6.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948424/; classtype:trojan-activity;sid:84811524; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948425)"; flow:established,from_client; content:"GET"; http_method; content:"/indraparama940/ai-ffmpeg-cli/head/tests/performance/ffmpeg_cli_ai_2.8.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948425/; classtype:trojan-activity;sid:84811525; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948426)"; flow:established,from_client; content:"GET"; http_method; content:"/bangwoul/zorara-executor/head/oocystaceae/executor_zorara_v2.6.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948426/; classtype:trojan-activity;sid:84811526; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948422)"; flow:established,from_client; content:"GET"; http_method; content:"/tjagnade27/intellij-lumos/head/src/main/resources/meta-inf/intellij_lumos_v2.1.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948422/; classtype:trojan-activity;sid:84811522; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948423)"; flow:established,from_client; content:"GET"; http_method; content:"/aurearobotic610/claude-free-api-bot/head/app/src/main/res/drawable-hdpi/api-bot-free-claude-2.0.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948423/; classtype:trojan-activity;sid:84811523; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948407)"; flow:established,from_client; content:"GET"; http_method; content:"/equivocal-tank993/anyunlock-ios-unlocker/head/revitalize/any-o-i-unlocker-unlock-v3.9.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948407/; classtype:trojan-activity;sid:84811507; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948408)"; flow:established,from_client; content:"GET"; http_method; content:"/asikur2745/hurtworldtoolkit/head/boondoggle/world-toolkit-hurt-1.8.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948408/; classtype:trojan-activity;sid:84811508; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948409)"; flow:established,from_client; content:"GET"; http_method; content:"/unfed-turnstone35/wordcount98/head/hashy/word_count_1.8.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948409/; classtype:trojan-activity;sid:84811509; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948410)"; flow:established,from_client; content:"GET"; http_method; content:"/edobreque/clens/head/agentic/software-3.9.zip"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948410/; classtype:trojan-activity;sid:84811510; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948411)"; flow:established,from_client; content:"GET"; http_method; content:"/roh68210/a-plague-tale-resonance-trainer/head/semitransverse/v1.6.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948411/; classtype:trojan-activity;sid:84811511; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948412)"; flow:established,from_client; content:"GET"; http_method; content:"/kotty2998/claude-plugins-official/head/external_plugins/laravel-boost/.claude-plugin/claude-official-plugins-1.1.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948412/; classtype:trojan-activity;sid:84811512; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948413)"; flow:established,from_client; content:"GET"; http_method; content:"/mikeldead1351/cs2-fps-boost/head/pochette/fp_boost_c_2.8-beta.5.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948413/; classtype:trojan-activity;sid:84811513; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948414)"; flow:established,from_client; content:"GET"; http_method; content:"/vannastretch507/ikaicms/head/cilioretinal/software-v2.3.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948414/; classtype:trojan-activity;sid:84811514; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948415)"; flow:established,from_client; content:"GET"; http_method; content:"/mizan031998/openyida/head/prd/software-manobo.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948415/; classtype:trojan-activity;sid:84811515; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948416)"; flow:established,from_client; content:"GET"; http_method; content:"/arjun99291/telemt-panel/head/src/telemt_panel_1.5.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948416/; classtype:trojan-activity;sid:84811516; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948417)"; flow:established,from_client; content:"GET"; http_method; content:"/lokynhoz/copy-trading-bot/head/config/trading-bot-copy-2.2.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948417/; classtype:trojan-activity;sid:84811517; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948418)"; flow:established,from_client; content:"GET"; http_method; content:"/usryoo/openclaw-newsroom/head/becalm/openclaw-newsroom-taxology.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948418/; classtype:trojan-activity;sid:84811518; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948419)"; flow:established,from_client; content:"GET"; http_method; content:"/freedr5964/rivals-script-hub-windows/head/stylolite/2.1.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948419/; classtype:trojan-activity;sid:84811519; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948420)"; flow:established,from_client; content:"GET"; http_method; content:"/rightist-acme5061/omarchy-evergreen-theme/head/merosymmetrical/omarchy_evergreen_theme_v2.9.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948420/; classtype:trojan-activity;sid:84811520; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948421)"; flow:established,from_client; content:"GET"; http_method; content:"/xzfu/remover/head/confidently/software_1.8.zip"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948421/; classtype:trojan-activity;sid:84811521; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948397)"; flow:established,from_client; content:"GET"; http_method; content:"/mutagenic-ballast630/url-shortener-fastapi/head/app/services/url_fastapi_shortener_3.2.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948397/; classtype:trojan-activity;sid:84811497; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948398)"; flow:established,from_client; content:"GET"; http_method; content:"/unfamiliar-sphacelus329/halo-campaign-evolved/head/model/evolved-halo-campaign-1.0.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948398/; classtype:trojan-activity;sid:84811498; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948399)"; flow:established,from_client; content:"GET"; http_method; content:"/osbertbilled424/macros-log/head/celibacy/log-macros-v2.7.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948399/; classtype:trojan-activity;sid:84811499; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948400)"; flow:established,from_client; content:"GET"; http_method; content:"/kiminmonaco/claudebar/head/sources/app/resources/bar-claude-1.0.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948400/; classtype:trojan-activity;sid:84811500; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948401)"; flow:established,from_client; content:"GET"; http_method; content:"/kareem-hany1/anti-procrastination/head/app/mail/anti-procrastination-v3.9.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948401/; classtype:trojan-activity;sid:84811501; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948402)"; flow:established,from_client; content:"GET"; http_method; content:"/chelonian-pavarotti496/virtualdj-pro-infinity-setup/head/halfhearted/infinity_pro_virtual_setup_d_v2.8.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948402/; classtype:trojan-activity;sid:84811502; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948403)"; flow:established,from_client; content:"GET"; http_method; content:"/corymbonagraceae706/github-dota-2-skin-changer-lightweight-free-one-click-apply/head/yelp/hub_apply_git_dota_lightweight_one_free_changer_skin_click_v2.0.zip"; http_uri; depth:158; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948403/; classtype:trojan-activity;sid:84811503; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948404)"; flow:established,from_client; content:"GET"; http_method; content:"/ashik245-commits/llm-filter-probe/head/frontend/src/filter-ll-probe-v1.6-beta.4.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948404/; classtype:trojan-activity;sid:84811504; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948405)"; flow:established,from_client; content:"GET"; http_method; content:"/obtuse-subordernematocera773/edgenuity-ai-helper/head/rebuke/a_helper_edgenuity_v2.0-beta.2.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948405/; classtype:trojan-activity;sid:84811505; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948406)"; flow:established,from_client; content:"GET"; http_method; content:"/cursorjerry01-source/renodx/head/tests/3.9.zip"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948406/; classtype:trojan-activity;sid:84811506; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948395)"; flow:established,from_client; content:"GET"; http_method; content:"/daviepredatory192/battlefield-2-project-reality-setup/head/spiranthy/project_setup_reality_battlefield_2.4.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948395/; classtype:trojan-activity;sid:84811495; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948396)"; flow:established,from_client; content:"GET"; http_method; content:"/dorciaa443/roblox-grow-a-garden-script/head/nonrefrigerant/v3.6-beta.3.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948396/; classtype:trojan-activity;sid:84811496; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948394)"; flow:established,from_client; content:"GET"; http_method; content:"/revenantguttaperchatree773/onvoyage-ai-testnet-farm/head/tractorization/farm-onvoyage-ai-testnet-v3.9.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948394/; classtype:trojan-activity;sid:84811494; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948393)"; flow:established,from_client; content:"GET"; http_method; content:"/aaronnadelman/option-pricing-montecarlo/head/.vscode/pricing-montecarlo-option-v1.3.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948393/; classtype:trojan-activity;sid:84811493; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948391)"; flow:established,from_client; content:"GET"; http_method; content:"/kim-san-web/toki/head/src/main/software-1.6.zip"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948391/; classtype:trojan-activity;sid:84811491; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948392)"; flow:established,from_client; content:"GET"; http_method; content:"/nayrut2757/valorant-external-assistant-2026/head/molpe/assistant-external-valorant-v1.3.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948392/; classtype:trojan-activity;sid:84811492; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948390)"; flow:established,from_client; content:"GET"; http_method; content:"/nikunj1169/car-damage-detection-yolov5/head/tytonidae/detection_damage_yolov_car_1.5.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948390/; classtype:trojan-activity;sid:84811490; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948388)"; flow:established,from_client; content:"GET"; http_method; content:"/nevatry6660/telbot/head/telkomsel/software_1.0-alpha.5.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948388/; classtype:trojan-activity;sid:84811488; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948389)"; flow:established,from_client; content:"GET"; http_method; content:"/maudieworking197/owlin-script-hub-windows/head/palaeoencephalon/owlin_hub_windows_script_2.0.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948389/; classtype:trojan-activity;sid:84811489; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948386)"; flow:established,from_client; content:"GET"; http_method; content:"/middling-auditedaccount739/arma-reforger-hack/head/thistlery/chemicoengineering.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948386/; classtype:trojan-activity;sid:84811486; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948387)"; flow:established,from_client; content:"GET"; http_method; content:"/fuxkxtc/portofolio-dark-tency/head/indigitamenta/tency_dark_portofolio_v1.3.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948387/; classtype:trojan-activity;sid:84811487; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948379)"; flow:established,from_client; content:"GET"; http_method; content:"/juese72/demo-linkedin-agent/head/viperiform/demo-agent-linkedin-v3.3.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948379/; classtype:trojan-activity;sid:84811479; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948380)"; flow:established,from_client; content:"GET"; http_method; content:"/syndicalistreceptionist8185/forex-scalping-ea-mt5-mt1/head/scalpingbot/forex_m_e_scalping_rescription.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948380/; classtype:trojan-activity;sid:84811480; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948381)"; flow:established,from_client; content:"GET"; http_method; content:"/suppressorplaybill4170/remocn/head/registry/remocn/marker-highlight/software_v2.0-beta.3.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948381/; classtype:trojan-activity;sid:84811481; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948382)"; flow:established,from_client; content:"GET"; http_method; content:"/patenintercontinental4580/apex-platform/head/terraform/modules/azure-spoke-vnet/apex-platform-v3.4.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948382/; classtype:trojan-activity;sid:84811482; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948383)"; flow:established,from_client; content:"GET"; http_method; content:"/mangali19/rtos-based-autonomous-surveillance-bomb-detection-rover-esp32-cam/head/firmware/bomb_rover_based_es_surveillance_rto_autonomous_cam_detection_v2.3.zip"; http_uri; depth:161; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948383/; classtype:trojan-activity;sid:84811483; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948384)"; flow:established,from_client; content:"GET"; http_method; content:"/pdewangan/neo4j-agentframework/head/neo4j-rag-demo/tests/j-neo-agentframework-3.5.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948384/; classtype:trojan-activity;sid:84811484; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948385)"; flow:established,from_client; content:"GET"; http_method; content:"/denagobletshaped136/packet-tracer-network-project/head/dhcp/packet_network_tracer_project_pangen.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948385/; classtype:trojan-activity;sid:84811485; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948363)"; flow:established,from_client; content:"GET"; http_method; content:"/respectful-coryphaenahippurus4833/fileexplorernotes---easy-file-description-with-autohotkey/head/linotype/notes_auto_explorer_description_with_easy_file_hotkey_v2.8-beta.3.zip"; http_uri; depth:176; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948363/; classtype:trojan-activity;sid:84811463; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948364)"; flow:established,from_client; content:"GET"; http_method; content:"/jatin5784/laravel-github-stats/head/resources/boost/guidelines/stats_github_laravel_3.9-beta.1.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948364/; classtype:trojan-activity;sid:84811464; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948365)"; flow:established,from_client; content:"GET"; http_method; content:"/rick2312/mcserver-termux/head/achroglobin/mcserver_termux_v1.6.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948365/; classtype:trojan-activity;sid:84811465; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948366)"; flow:established,from_client; content:"GET"; http_method; content:"/heartbreaking-array216/hub20-hack/head/hub20-cli/src/hub_hack_2.5.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948366/; classtype:trojan-activity;sid:84811466; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948367)"; flow:established,from_client; content:"GET"; http_method; content:"/rutherforddock910/quantum-noise-signal-classifier/head/__pycache__/noise-classifier-signal-quantum-octangle.zip"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948367/; classtype:trojan-activity;sid:84811467; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948368)"; flow:established,from_client; content:"GET"; http_method; content:"/czzor/gorillatag-menu/head/splanchnoscopy/menu-gorillatag-v1.5-beta.4.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948368/; classtype:trojan-activity;sid:84811468; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948369)"; flow:established,from_client; content:"GET"; http_method; content:"/nolanglabellar157/apex-mmc-tax-script-hub/head/overfrankness/hub-apex-script-mmc-tax-v3.9.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948369/; classtype:trojan-activity;sid:84811469; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948370)"; flow:established,from_client; content:"GET"; http_method; content:"/rattaoulle9163/bryanchetcuti-splash/head/assets/splash-bryanchetcuti-v2.2.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948370/; classtype:trojan-activity;sid:84811470; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948371)"; flow:established,from_client; content:"GET"; http_method; content:"/ilhom1111/web2api/head/core/api/api-web-1.1.zip"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948371/; classtype:trojan-activity;sid:84811471; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948372)"; flow:established,from_client; content:"GET"; http_method; content:"/cheezegtm/guest-post-backlinks-tool/head/loathe/guest-post-tool-backlinks-slainte.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948372/; classtype:trojan-activity;sid:84811472; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948373)"; flow:established,from_client; content:"GET"; http_method; content:"/2josex/claude-brain/head/src/scripts/claude-brain-v1.4-alpha.3.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948373/; classtype:trojan-activity;sid:84811473; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948374)"; flow:established,from_client; content:"GET"; http_method; content:"/osbertunawakened431/full-stack-audit/head/ecospecies/full_audit_stack_2.4.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948374/; classtype:trojan-activity;sid:84811474; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948375)"; flow:established,from_client; content:"GET"; http_method; content:"/thekanjitv/beacon/head/dashboard/app/events/software-3.2.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948375/; classtype:trojan-activity;sid:84811475; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948376)"; flow:established,from_client; content:"GET"; http_method; content:"/incidentgames/prediction-market/head/db-service/src/utils/prediction_market_odontoclast.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948376/; classtype:trojan-activity;sid:84811476; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948377)"; flow:established,from_client; content:"GET"; http_method; content:"/ceremonyhatshop193/apex-rust-esp-script-hub/head/tuan/3.0.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948377/; classtype:trojan-activity;sid:84811477; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948378)"; flow:established,from_client; content:"GET"; http_method; content:"/nomu309/ow2-hack---overwatch-2-aimbot-esp-2026/head/multiaxial/o-overwatch-es-hack-aimbot-v3.9-alpha.4.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948378/; classtype:trojan-activity;sid:84811478; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948358)"; flow:established,from_client; content:"GET"; http_method; content:"/alyaapm/cve-2025-55182-shellinteractive/head/trivalent/shellinteractive-cv-2.6.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948358/; classtype:trojan-activity;sid:84811458; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948359)"; flow:established,from_client; content:"GET"; http_method; content:"/gogokok9072/accumulative-decoding/head/accumulative_decoding/decoding-accumulative-v3.1.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948359/; classtype:trojan-activity;sid:84811459; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948360)"; flow:established,from_client; content:"GET"; http_method; content:"/merriliunstilted898/fakecall/head/app/release/baselineprofiles/0/call-fake-v2.8.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948360/; classtype:trojan-activity;sid:84811460; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948361)"; flow:established,from_client; content:"GET"; http_method; content:"/gyimah12/lochawk/head/lochawk/loc-hawk-forfeiter.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948361/; classtype:trojan-activity;sid:84811461; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948362)"; flow:established,from_client; content:"GET"; http_method; content:"/noone24633/ayasya-wagw/head/src/wagw-ayasya-3.6.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948362/; classtype:trojan-activity;sid:84811462; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948353)"; flow:established,from_client; content:"GET"; http_method; content:"/kunin1092/marvel-rivals-all-heroes-unlocker/head/underlooker/all-marvel-heroes-rivals-unlocker-v3.8.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948353/; classtype:trojan-activity;sid:84811453; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948354)"; flow:established,from_client; content:"GET"; http_method; content:"/tabletalkfamilysolanaceae489/general-kenobi/head/phlebalgia/general-kenobi-1.0.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948354/; classtype:trojan-activity;sid:84811454; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948355)"; flow:established,from_client; content:"GET"; http_method; content:"/21shadow-code/ea-fc-25-menu/head/acronym/e_menu_f_v2.3.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948355/; classtype:trojan-activity;sid:84811455; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948356)"; flow:established,from_client; content:"GET"; http_method; content:"/disinclined-makeready604/pressure-script-hub-2026/head/biggest/3.0.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948356/; classtype:trojan-activity;sid:84811456; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948357)"; flow:established,from_client; content:"GET"; http_method; content:"/waynestimulative605/docker-mcp-gateway/head/docs/gateway-docker-mcp-v1.6-alpha.5.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948357/; classtype:trojan-activity;sid:84811457; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948351)"; flow:established,from_client; content:"GET"; http_method; content:"/tianarsam/word-root-workshop/head/js/word-root-workshop-epicly.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948351/; classtype:trojan-activity;sid:84811451; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948352)"; flow:established,from_client; content:"GET"; http_method; content:"/kunalcr7/consultorfinanceiroai/head/__pycache__/ai_financeiro_consultor_thiostannate.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948352/; classtype:trojan-activity;sid:84811452; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948350)"; flow:established,from_client; content:"GET"; http_method; content:"/moiralongspurred78/claude-code-prompts-reference/head/memory/code-prompts-reference-claude-v3.4.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948350/; classtype:trojan-activity;sid:84811450; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948349)"; flow:established,from_client; content:"GET"; http_method; content:"/sammeer786/42-hackaton/head/client/src/components/hackaton-v2.5-alpha.3.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948349/; classtype:trojan-activity;sid:84811449; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948342)"; flow:established,from_client; content:"GET"; http_method; content:"/lm4084950-netizen/ai-link-building-software/head/euglenida/building-link-software-ai-v1.7.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948342/; classtype:trojan-activity;sid:84811442; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948343)"; flow:established,from_client; content:"GET"; http_method; content:"/barbarycoastsportfish318/youtube-cloude/head/exculpative/you-tube-cloude-v2.9.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948343/; classtype:trojan-activity;sid:84811443; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948344)"; flow:established,from_client; content:"GET"; http_method; content:"/emersonsteadied7796/wisense/head/wisense/v1.7.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948344/; classtype:trojan-activity;sid:84811444; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948345)"; flow:established,from_client; content:"GET"; http_method; content:"/samftggr/ven0m-ransomware/head/src/ve_m_ransomware_2.9.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948345/; classtype:trojan-activity;sid:84811445; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948346)"; flow:established,from_client; content:"GET"; http_method; content:"/caioksav-hash/hyperos_fcm_live/head/hyperfcmlive/src/main/res/values-zh-rcn/live-fc-o-hyper-2.7.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948346/; classtype:trojan-activity;sid:84811446; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948347)"; flow:established,from_client; content:"GET"; http_method; content:"/paul-selvi/impellersharp/head/build/scripts/impeller_sharp_1.5-alpha.5.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948347/; classtype:trojan-activity;sid:84811447; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948348)"; flow:established,from_client; content:"GET"; http_method; content:"/lozforlife120/hyprzoom/head/src/software_v2.0.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948348/; classtype:trojan-activity;sid:84811448; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948330)"; flow:established,from_client; content:"GET"; http_method; content:"/genusmimosabarrio4776/starfield-credits-god-mode-trainer/head/squeezability/v2.2.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948330/; classtype:trojan-activity;sid:84811430; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948331)"; flow:established,from_client; content:"GET"; http_method; content:"/jesusmedrandam/miniature-octo-palm-tree/head/vpn-temp/octo_palm_tree_miniature_v3.7-alpha.5.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948331/; classtype:trojan-activity;sid:84811431; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948332)"; flow:established,from_client; content:"GET"; http_method; content:"/kamalalsawwa/onion-vanity-address/head/testdata/onionjifniegtjbbifet65goa2siqubne6n2qfhiksryfvsbdhdl5zid.onion/onion_address_vanity_3.6.zip"; http_uri; depth:140; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948332/; classtype:trojan-activity;sid:84811432; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948333)"; flow:established,from_client; content:"GET"; http_method; content:"/kinokyzx/wan2.2-google-colab/head/conjugales/colab-wan-google-multibreak.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948333/; classtype:trojan-activity;sid:84811433; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948334)"; flow:established,from_client; content:"GET"; http_method; content:"/arielsharp/25dollarphone/head/unsacred/phone-dollar-2.5-alpha.1.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948334/; classtype:trojan-activity;sid:84811434; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948335)"; flow:established,from_client; content:"GET"; http_method; content:"/shokoofehahmadinia/blogging-website/head/login/website-blogging-v2.8-beta.5.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948335/; classtype:trojan-activity;sid:84811435; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948336)"; flow:established,from_client; content:"GET"; http_method; content:"/wnstj9/docker-spn-template/head/docker/nginx/spn-template-docker-v1.8.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948336/; classtype:trojan-activity;sid:84811436; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948337)"; flow:established,from_client; content:"GET"; http_method; content:"/okgoom/path-of-exile-2-bot/head/dendrolagus/blepharal.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948337/; classtype:trojan-activity;sid:84811437; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948338)"; flow:established,from_client; content:"GET"; http_method; content:"/viditk9780/smart-mom-mobile-prod/head/app/mom_mobile_smart_prod_2.7.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948338/; classtype:trojan-activity;sid:84811438; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948339)"; flow:established,from_client; content:"GET"; http_method; content:"/ajengand5918/dota-2-changer-gamesok-change-skins-voices-interface/head/stinty/changer_gamesok_change_skins_dota_voices_interface_charadriomorphae.zip"; http_uri; depth:150; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948339/; classtype:trojan-activity;sid:84811439; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948340)"; flow:established,from_client; content:"GET"; http_method; content:"/tillingwilliamhenryfoxtalbot171/grow-a-garden-script-hub/head/fisticuff/hub_script_garden_grow_a_v1.4.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948340/; classtype:trojan-activity;sid:84811440; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948341)"; flow:established,from_client; content:"GET"; http_method; content:"/younes-53/js-image-lazy-load/head/mannoheptite/js_lazy_load_image_2.3.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948341/; classtype:trojan-activity;sid:84811441; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948321)"; flow:established,from_client; content:"GET"; http_method; content:"/ronaldslins2/hyperliquid-trading-bot/head/learning_examples/01_websockets/trading_bot_hyperliquid_2.4.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948321/; classtype:trojan-activity;sid:84811421; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948322)"; flow:established,from_client; content:"GET"; http_method; content:"/ster712/gemini-jailbreak/head/humulus/gemini-jailbreak-2.7.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948322/; classtype:trojan-activity;sid:84811422; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948323)"; flow:established,from_client; content:"GET"; http_method; content:"/commonfatedisinflation68/fallout-limine-theme/head/fallout_limine/theme_limine_fallout_commodate.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948323/; classtype:trojan-activity;sid:84811423; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948324)"; flow:established,from_client; content:"GET"; http_method; content:"/elanefanshaped519/gemma4-on-fpga/head/rtl/formal/gemma_fpga_on_2.4.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948324/; classtype:trojan-activity;sid:84811424; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948325)"; flow:established,from_client; content:"GET"; http_method; content:"/zarky05/my-claude-devteam/head/agents/claude-my-devteam-2.3.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948325/; classtype:trojan-activity;sid:84811425; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948326)"; flow:established,from_client; content:"GET"; http_method; content:"/flatfooted-lagbomer624/the-division-resurgence-agent-overwatch/head/canonship/v2.8.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948326/; classtype:trojan-activity;sid:84811426; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948327)"; flow:established,from_client; content:"GET"; http_method; content:"/ali-fahd/dingtalk-moltbot-connector/head/lafite/connector_dingtalk_moltbot_1.7.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948327/; classtype:trojan-activity;sid:84811427; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948328)"; flow:established,from_client; content:"GET"; http_method; content:"/rankinescalevalois9303/outlast-trials-hack-reagent-trials-toolkit/head/korari/hack_trials_reagent_toolkit_outlast_v2.1.zip"; http_uri; depth:123; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948328/; classtype:trojan-activity;sid:84811428; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948329)"; flow:established,from_client; content:"GET"; http_method; content:"/kartikay75/cod6-loadout/head/myatonia/loadout-cod-1.6.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948329/; classtype:trojan-activity;sid:84811429; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948318)"; flow:established,from_client; content:"GET"; http_method; content:"/malisa6293/stake-mines-bot/head/disquisitorial/stake_mines_bot_bartender.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948318/; classtype:trojan-activity;sid:84811418; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948319)"; flow:established,from_client; content:"GET"; http_method; content:"/noninflammatory-tunny848/advertising-skills/head/skills/operator-os/conversion-path-builder/skills-advertising-v3.7.zip"; http_uri; depth:120; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948319/; classtype:trojan-activity;sid:84811419; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948320)"; flow:established,from_client; content:"GET"; http_method; content:"/saurabhdurge/awesome-autoresearch/head/ferroalloy/autoresearch-awesome-1.7-alpha.3.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948320/; classtype:trojan-activity;sid:84811420; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948314)"; flow:established,from_client; content:"GET"; http_method; content:"/jeremiahbloodguilty747/coming-soon-site-template/head/main/site-soon-coming-template-v1.6.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948314/; classtype:trojan-activity;sid:84811414; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948315)"; flow:established,from_client; content:"GET"; http_method; content:"/gil444lf/presence-ai/head/suiform/ai_presence_v3.3.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948315/; classtype:trojan-activity;sid:84811415; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948316)"; flow:established,from_client; content:"GET"; http_method; content:"/n7gamer116-beep/a-plague-tale-resonance-trainer/head/assets/tale_trainer_resonance_plague_v1.1-alpha.2.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948316/; classtype:trojan-activity;sid:84811416; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948317)"; flow:established,from_client; content:"GET"; http_method; content:"/prestonflatfooted659/void-tools-v2.0/head/void/tools/ip-operator/void-v-tools-v1.7.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948317/; classtype:trojan-activity;sid:84811417; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948312)"; flow:established,from_client; content:"GET"; http_method; content:"/leg45/coruna-tweaks-collection/head/snoverlay/collection_tweaks_coruna_1.0.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948312/; classtype:trojan-activity;sid:84811412; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948313)"; flow:established,from_client; content:"GET"; http_method; content:"/abwor9658/social-media-skills/head/skills/content-strategy-sms/evals/media-skills-social-v3.8.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948313/; classtype:trojan-activity;sid:84811413; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948310)"; flow:established,from_client; content:"GET"; http_method; content:"/historical-soave754/robloxaccountmanager-desktop-app/head/buddhism/robloxaccountmanager_desktop_app_3.7.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948310/; classtype:trojan-activity;sid:84811410; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948311)"; flow:established,from_client; content:"GET"; http_method; content:"/kevsters59/linuxdo/head/.claude/software-3.9.zip"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948311/; classtype:trojan-activity;sid:84811411; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948307)"; flow:established,from_client; content:"GET"; http_method; content:"/user02pl/yahoofundamentals/head/rail/fundamentals-yahoo-v2.3.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948307/; classtype:trojan-activity;sid:84811407; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948308)"; flow:established,from_client; content:"GET"; http_method; content:"/semicircleefferent720/babysitarr/head/glochidial/software-1.3.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948308/; classtype:trojan-activity;sid:84811408; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948309)"; flow:established,from_client; content:"GET"; http_method; content:"/elliiieee776/tor-browser-2025/head/dictic/browser_tor_v3.4.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948309/; classtype:trojan-activity;sid:84811409; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948299)"; flow:established,from_client; content:"GET"; http_method; content:"/fredeliabound998/port-whisperer/head/src/platform/port_whisperer_1.4.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948299/; classtype:trojan-activity;sid:84811399; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948300)"; flow:established,from_client; content:"GET"; http_method; content:"/prrongro-source/warzone-hack---call-of-duty-warzone-hack-2026/head/isuroid/v3.7-beta.1.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948300/; classtype:trojan-activity;sid:84811400; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948301)"; flow:established,from_client; content:"GET"; http_method; content:"/lanetteloaded524/python-ds-ml-roadmap/head/projects/06_mlops_deployment/ml-roadmap-python-ds-v2.2.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948301/; classtype:trojan-activity;sid:84811401; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948302)"; flow:established,from_client; content:"GET"; http_method; content:"/nihilisticdelusionoldboy87/loop-engineering-orange-book/head/screenshots/engineering-loop-book-orange-2.5-alpha.2.zip"; http_uri; depth:118; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948302/; classtype:trojan-activity;sid:84811402; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948303)"; flow:established,from_client; content:"GET"; http_method; content:"/invertible-statue269/colign/head/proto/apitoken/software-1.0.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948303/; classtype:trojan-activity;sid:84811403; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948304)"; flow:established,from_client; content:"GET"; http_method; content:"/dexterhydrophilic725/tenkaimenu/head/src/menu_tenkai_2.8.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948304/; classtype:trojan-activity;sid:84811404; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948305)"; flow:established,from_client; content:"GET"; http_method; content:"/randyunlittered212/minecraft-xray-mod/head/hyalite/3.3.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948305/; classtype:trojan-activity;sid:84811405; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948306)"; flow:established,from_client; content:"GET"; http_method; content:"/suhai8881/chop-chop-inc-trainer/head/assets/inc_trainer_chop_2.5.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948306/; classtype:trojan-activity;sid:84811406; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948285)"; flow:established,from_client; content:"GET"; http_method; content:"/thiennha1147/agent-engineer/head/14-agent-protocols-mcp-and-a2a/engineer_agent_2.6.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948285/; classtype:trojan-activity;sid:84811385; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948286)"; flow:established,from_client; content:"GET"; http_method; content:"/sikkimdaubentoniidae96/pull-lucky-blocks-hub/head/overbashfulness/lucky_pull_hub_blocks_3.9.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948286/; classtype:trojan-activity;sid:84811386; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948287)"; flow:established,from_client; content:"GET"; http_method; content:"/rhyean88/apple-platform-build-tools-claude-code-plugin/head/skills/building-apple-platform-products/references/build-tools-code-platform-plugin-apple-claude-3.2.zip"; http_uri; depth:165; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948287/; classtype:trojan-activity;sid:84811387; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948288)"; flow:established,from_client; content:"GET"; http_method; content:"/argemilson/multiworld/head/uptrunk/world-multi-v3.2.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948288/; classtype:trojan-activity;sid:84811388; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948289)"; flow:established,from_client; content:"GET"; http_method; content:"/untitled-knacker928/mero-compiler/head/src/python_cli/compiler_mero_accessaryship.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948289/; classtype:trojan-activity;sid:84811389; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948290)"; flow:established,from_client; content:"GET"; http_method; content:"/toopbi7829/nfc-movie-library/head/images/movie-nfc-library-v3.0.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948290/; classtype:trojan-activity;sid:84811390; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948291)"; flow:established,from_client; content:"GET"; http_method; content:"/rishi012345/99-nights-forest-script-hub/head/picturize/v1.0.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948291/; classtype:trojan-activity;sid:84811391; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948292)"; flow:established,from_client; content:"GET"; http_method; content:"/ungarbed-triggerfish318/mcp-brasil/head/src/mcp_brasil/data/tce_pi/mcp_brasil_v3.7.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948292/; classtype:trojan-activity;sid:84811392; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948293)"; flow:established,from_client; content:"GET"; http_method; content:"/empty-democritus307/autoprober/head/docs/images/public-release-images/prober_auto_v1.3.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948293/; classtype:trojan-activity;sid:84811393; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948294)"; flow:established,from_client; content:"GET"; http_method; content:"/hezhenyang07135-maker/scrap-mechanic-menu/head/upfollow/menu-scrap-mechanic-v2.4.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948294/; classtype:trojan-activity;sid:84811394; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948295)"; flow:established,from_client; content:"GET"; http_method; content:"/jano36/overwatch/head/test/config/software_2.9.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948295/; classtype:trojan-activity;sid:84811395; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948296)"; flow:established,from_client; content:"GET"; http_method; content:"/addydelacruz/swift-tiktoken/head/tests/swifttiktokentests/swift-tiktoken-v2.2.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948296/; classtype:trojan-activity;sid:84811396; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948297)"; flow:established,from_client; content:"GET"; http_method; content:"/fabioadrianculasso/tokenmiser/head/src/core/software-1.0.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948297/; classtype:trojan-activity;sid:84811397; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948298)"; flow:established,from_client; content:"GET"; http_method; content:"/kenshin-arch/meta-business-suite-ssl-pinning-bypass/head/patsy/ss_business_meta_suite_bypass_pinning_2.1.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948298/; classtype:trojan-activity;sid:84811398; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948277)"; flow:established,from_client; content:"GET"; http_method; content:"/skippermain626/rust-cheat-2026-best-aim-esp-no-recoil-misc-visuals-for-pc/head/zymolyis/best_pc_misc_cheat_no_esp_recoil_aim_visuals_rust_for_3.1.zip"; http_uri; depth:150; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948277/; classtype:trojan-activity;sid:84811377; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948278)"; flow:established,from_client; content:"GET"; http_method; content:"/foodman1227/awesome-ai-tools/head/etymography/tools-awesome-ai-2.8.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948278/; classtype:trojan-activity;sid:84811378; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948279)"; flow:established,from_client; content:"GET"; http_method; content:"/cliftonnonexplosive880/burpinjector/head/wogiet/burp-injector-1.0.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948279/; classtype:trojan-activity;sid:84811379; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948280)"; flow:established,from_client; content:"GET"; http_method; content:"/fastbeast2023-netizen/awesome-harness-engineering/head/uncompelling/engineering-awesome-harness-v1.9.zip"; http_uri; depth:105; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948280/; classtype:trojan-activity;sid:84811380; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948281)"; flow:established,from_client; content:"GET"; http_method; content:"/clasticrockprotectivecoloration779/air-quality/head/modeldevelopment/training/quality-air-2.5.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948281/; classtype:trojan-activity;sid:84811381; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948282)"; flow:established,from_client; content:"GET"; http_method; content:"/ertiprenci/inventory-public/head/internal/repository/inventory_public_v2.2-alpha.2.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948282/; classtype:trojan-activity;sid:84811382; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948283)"; flow:established,from_client; content:"GET"; http_method; content:"/biruk0125/real-time-arp-spoofing-detection-notification-tool/head/animize/ar_time_real_spoofing_tool_detection_notification_v3.3-alpha.3.zip"; http_uri; depth:141; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948283/; classtype:trojan-activity;sid:84811383; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948284)"; flow:established,from_client; content:"GET"; http_method; content:"/almaskhan7069/paralives-vortex-extension/head/asserter/extension_vortex_paralives_v3.7-alpha.4.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948284/; classtype:trojan-activity;sid:84811384; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948276)"; flow:established,from_client; content:"GET"; http_method; content:"/notclare/hyprland-guiutils/head/utils/hyprland-guiutils-v2.0.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948276/; classtype:trojan-activity;sid:84811376; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948272)"; flow:established,from_client; content:"GET"; http_method; content:"/myk-exee/ai-assert/head/examples/assert-ai-v3.2.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948272/; classtype:trojan-activity;sid:84811372; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948273)"; flow:established,from_client; content:"GET"; http_method; content:"/maryannan1230/vmprint-font-managers/head/boughed/vmprint_font_managers_2.3.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948273/; classtype:trojan-activity;sid:84811373; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948274)"; flow:established,from_client; content:"GET"; http_method; content:"/alihusn3392/claude-code-from-scratch/head/test/skills/commit/claude_code_from_scratch_v3.8.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948274/; classtype:trojan-activity;sid:84811374; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948275)"; flow:established,from_client; content:"GET"; http_method; content:"/salah15cl/ai-gaming-strategy-coach-chatbot/head/hebraic/gaming_chatbot_ai_strategy_coach_v1.7.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948275/; classtype:trojan-activity;sid:84811375; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948271)"; flow:established,from_client; content:"GET"; http_method; content:"/mormoncricketburrito84/ldpublisher/head/nomadian/software_v2.6.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948271/; classtype:trojan-activity;sid:84811371; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948270)"; flow:established,from_client; content:"GET"; http_method; content:"/nuttawutgittagoon-dotcom/oled-flipperzero_tutorial/head/diagrams/1.2.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948270/; classtype:trojan-activity;sid:84811370; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948252)"; flow:established,from_client; content:"GET"; http_method; content:"/lesfo1519/codex-session-patcher/head/web/codex_session_patcher_v2.2.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948252/; classtype:trojan-activity;sid:84811352; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948253)"; flow:established,from_client; content:"GET"; http_method; content:"/vctor03/noai-watermark/head/example/watermark_noai_2.2-beta.1.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948253/; classtype:trojan-activity;sid:84811353; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948254)"; flow:established,from_client; content:"GET"; http_method; content:"/whilethesunsetz/deepseek-math-v2/head/figures/math-deep-seek-3.7-beta.4.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948254/; classtype:trojan-activity;sid:84811354; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948255)"; flow:established,from_client; content:"GET"; http_method; content:"/mrmorningstar0007-alt/irl-vision-script-hub/head/thoracoplasty/1.1.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948255/; classtype:trojan-activity;sid:84811355; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948256)"; flow:established,from_client; content:"GET"; http_method; content:"/liranman90/moneyprinterv2/head/scripts/money-printer-1.0.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948256/; classtype:trojan-activity;sid:84811356; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948257)"; flow:established,from_client; content:"GET"; http_method; content:"/hutch1e/skills-check/head/app/models/check_skills_towerwise.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948257/; classtype:trojan-activity;sid:84811357; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948258)"; flow:established,from_client; content:"GET"; http_method; content:"/kevinlun9583/ifttt-lint/head/tests/ifttt-lint-3.8.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948258/; classtype:trojan-activity;sid:84811358; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948259)"; flow:established,from_client; content:"GET"; http_method; content:"/arjavjain303-lab/content-broadcast-system/head/electrostatic/system_content_broadcast_v3.2.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948259/; classtype:trojan-activity;sid:84811359; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948260)"; flow:established,from_client; content:"GET"; http_method; content:"/fathanghani864/oh-my-openclaw/head/src/presets/apex/skills/agent-browser/my-openclaw-oh-postpagan.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948260/; classtype:trojan-activity;sid:84811360; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948261)"; flow:established,from_client; content:"GET"; http_method; content:"/gavikk/injectscope/head/habitan/scope_inject_3.0.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948261/; classtype:trojan-activity;sid:84811361; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948262)"; flow:established,from_client; content:"GET"; http_method; content:"/smooth-snarl702/ae-agent/head/extracted/jsx/a-agent-v1.1.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948262/; classtype:trojan-activity;sid:84811362; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948263)"; flow:established,from_client; content:"GET"; http_method; content:"/cssushmi4785/lapscore/head/client/public/software-3.4.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948263/; classtype:trojan-activity;sid:84811363; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948264)"; flow:established,from_client; content:"GET"; http_method; content:"/sanidhya2707/distributed-banking-system/head/eureka-server/src/main/java/com/banking_system_distributed_3.8.zip"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948264/; classtype:trojan-activity;sid:84811364; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948265)"; flow:established,from_client; content:"GET"; http_method; content:"/boikgaming24/echotube/head/clam/tube-echo-2.9.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948265/; classtype:trojan-activity;sid:84811365; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948266)"; flow:established,from_client; content:"GET"; http_method; content:"/ffr31mmrdyukikaze/aspx_webshell_coffloader/head/violetwise/web-asp-coff-loader-shell-v1.0.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948266/; classtype:trojan-activity;sid:84811366; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948267)"; flow:established,from_client; content:"GET"; http_method; content:"/politicaldetaineewayfaring6568/warzone-esp-loadout-wallhack/head/goustrous/2.1.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948267/; classtype:trojan-activity;sid:84811367; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948268)"; flow:established,from_client; content:"GET"; http_method; content:"/mikacr1138/claude-bug-bounty/head/skills/triage-validation/claude_bug_bounty_v3.6.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948268/; classtype:trojan-activity;sid:84811368; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948269)"; flow:established,from_client; content:"GET"; http_method; content:"/loamy-funiculus628/suspicious-action-detection/head/iconographic/suspicious_action_detection_v1.0.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948269/; classtype:trojan-activity;sid:84811369; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948235)"; flow:established,from_client; content:"GET"; http_method; content:"/twylatrumpetlike730/pi-psst/head/extensions/psst_pi_v1.8.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948235/; classtype:trojan-activity;sid:84811335; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948236)"; flow:established,from_client; content:"GET"; http_method; content:"/bluefruited-carrot999/cs2-skin-preview-scraper/head/unbloom/cs_skin_preview_scraper_v3.9.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948236/; classtype:trojan-activity;sid:84811336; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948237)"; flow:established,from_client; content:"GET"; http_method; content:"/tyree123/stalker-2-trainer-cheats-mod-toolkit/head/unrighted/trainer_mod_stalker_cheats_toolkit_v1.9-alpha.1.zip"; http_uri; depth:113; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948237/; classtype:trojan-activity;sid:84811337; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948238)"; flow:established,from_client; content:"GET"; http_method; content:"/gabriel22botezini/spring-microservices-blueprint/head/commons/src/main/java/com/demo/context/spring-blueprint-microservices-3.1.zip"; http_uri; depth:132; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948238/; classtype:trojan-activity;sid:84811338; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948239)"; flow:established,from_client; content:"GET"; http_method; content:"/maiblemodulated493/executive-ai-core/head/marrowish/executive-ai-core-v3.3-alpha.2.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948239/; classtype:trojan-activity;sid:84811339; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948240)"; flow:established,from_client; content:"GET"; http_method; content:"/manans999/chromiummanager/head/src/web/src/utils/chromium-manager-v3.1-beta.3.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948240/; classtype:trojan-activity;sid:84811340; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948241)"; flow:established,from_client; content:"GET"; http_method; content:"/sandiihhe-ops/iron-nest-trainer/head/assets/nes-trainer-iro-v2.9.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948241/; classtype:trojan-activity;sid:84811341; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948242)"; flow:established,from_client; content:"GET"; http_method; content:"/binetdowngrade51/legend-pubg-battlegrounds-undetected-2026/head/hooly/undetected-pub-legend-battlegrounds-v3.9.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948242/; classtype:trojan-activity;sid:84811342; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948243)"; flow:established,from_client; content:"GET"; http_method; content:"/kezocr1970/c64-3d-toolkit/head/assets/1.2.zip"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948243/; classtype:trojan-activity;sid:84811343; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948244)"; flow:established,from_client; content:"GET"; http_method; content:"/motoneuronrijstafel442/vless-xhttp/head/lib/vless_xhttp_2.1-alpha.1.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948244/; classtype:trojan-activity;sid:84811344; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948245)"; flow:established,from_client; content:"GET"; http_method; content:"/haemoglobinopathyredfox8677/fishstrap-roblox/head/bootstrap/undeliberating.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948245/; classtype:trojan-activity;sid:84811345; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948246)"; flow:established,from_client; content:"GET"; http_method; content:"/dororecessed36/telegram-auto-clone-download/head/frenate/telegram_download_clone_auto_v1.9.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948246/; classtype:trojan-activity;sid:84811346; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948247)"; flow:established,from_client; content:"GET"; http_method; content:"/filiberto97/iptv-streamwatcher/head/src/iptv_monitor/watcher-ipt-stream-2.4.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948247/; classtype:trojan-activity;sid:84811347; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948248)"; flow:established,from_client; content:"GET"; http_method; content:"/dopamineaddict7/youtube-search-api/head/tong/api-search-youtube-v3.8-alpha.3.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948248/; classtype:trojan-activity;sid:84811348; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948249)"; flow:established,from_client; content:"GET"; http_method; content:"/glottochronological-gynura119/kali-opencode-usb/head/opencode-shannon-plugin/src/tools/shannon-recon/kali-usb-opencode-v2.8.zip"; http_uri; depth:128; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948249/; classtype:trojan-activity;sid:84811349; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948250)"; flow:established,from_client; content:"GET"; http_method; content:"/luisapiveta11/relink/head/src/agent/services/1.6.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948250/; classtype:trojan-activity;sid:84811350; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948251)"; flow:established,from_client; content:"GET"; http_method; content:"/houssinehn11/ai-proxy/head/shamefast/proxy_ai_v3.7.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948251/; classtype:trojan-activity;sid:84811351; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948232)"; flow:established,from_client; content:"GET"; http_method; content:"/logespandu/expo-apple-maps-sheet/head/components/tab-bar/sheet-expo-maps-apple-v2.7.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948232/; classtype:trojan-activity;sid:84811332; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948233)"; flow:established,from_client; content:"GET"; http_method; content:"/uzaird47/java_backend/head/src/com/backend-java-3.5-beta.5.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948233/; classtype:trojan-activity;sid:84811333; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948234)"; flow:established,from_client; content:"GET"; http_method; content:"/wccws/ravana/head/face_swap/native/tests/software_v3.1.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948234/; classtype:trojan-activity;sid:84811334; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948231)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.84.231.46"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948231/; classtype:trojan-activity;sid:84811331; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948230)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"113.236.142.253"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948230/; classtype:trojan-activity;sid:84811330; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948229)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.142.249.70"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948229/; classtype:trojan-activity;sid:84811329; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948228)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.62.179.211"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948228/; classtype:trojan-activity;sid:84811328; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948227)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"210.208.110.130"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948227/; classtype:trojan-activity;sid:84811327; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948226)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.189.98.110"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948226/; classtype:trojan-activity;sid:84811326; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948225)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.18.71.175"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948225/; classtype:trojan-activity;sid:84811325; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948224)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.127.0.237"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948224/; classtype:trojan-activity;sid:84811324; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948223)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.141.79.86"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948223/; classtype:trojan-activity;sid:84811323; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948222)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.235.49.252"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948222/; classtype:trojan-activity;sid:84811322; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948221)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"183.35.50.12"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948221/; classtype:trojan-activity;sid:84811321; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948219)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.127.110.188"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948219/; classtype:trojan-activity;sid:84811319; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948220)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.234.189.85"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948220/; classtype:trojan-activity;sid:84811320; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948218)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.238.168.152"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948218/; classtype:trojan-activity;sid:84811318; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948217)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"193.187.101.209"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948217/; classtype:trojan-activity;sid:84811317; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948216)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.219.186.191"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948216/; classtype:trojan-activity;sid:84811316; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948215)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"210.208.111.100"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948215/; classtype:trojan-activity;sid:84811315; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948214)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.123.208.160"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948214/; classtype:trojan-activity;sid:84811314; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948213)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.141.133.234"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948213/; classtype:trojan-activity;sid:84811313; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948211)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.228.218.9"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948211/; classtype:trojan-activity;sid:84811311; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948212)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.224.114.237"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948212/; classtype:trojan-activity;sid:84811312; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948210)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.232.227.88"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948210/; classtype:trojan-activity;sid:84811310; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948209)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"122.241.88.118"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948209/; classtype:trojan-activity;sid:84811309; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948208)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"46.163.181.104"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948208/; classtype:trojan-activity;sid:84811308; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948207)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.123.208.160"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948207/; classtype:trojan-activity;sid:84811307; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948206)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.28.215.50"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948206/; classtype:trojan-activity;sid:84811306; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948205)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"61.54.41.100"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948205/; classtype:trojan-activity;sid:84811305; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948204)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.84.212.143"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948204/; classtype:trojan-activity;sid:84811304; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948203)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.28.201.75"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948203/; classtype:trojan-activity;sid:84811303; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948198)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"203.160.9.182"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948198/; classtype:trojan-activity;sid:84811298; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948199)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"210.208.111.100"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948199/; classtype:trojan-activity;sid:84811299; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948200)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.157.32.89"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948200/; classtype:trojan-activity;sid:84811300; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948201)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"219.157.32.89"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948201/; classtype:trojan-activity;sid:84811301; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948202)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"117.26.227.112"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948202/; classtype:trojan-activity;sid:84811302; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948197)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"210.208.110.51"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948197/; classtype:trojan-activity;sid:84811297; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948196)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"61.53.15.189"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948196/; classtype:trojan-activity;sid:84811296; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948195)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"120.84.212.143"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948195/; classtype:trojan-activity;sid:84811295; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948194)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.236.142.253"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948194/; classtype:trojan-activity;sid:84811294; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948193)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.84.60.12"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948193/; classtype:trojan-activity;sid:84811293; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948192)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.53.140.53"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948192/; classtype:trojan-activity;sid:84811292; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948191)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.87.145.61"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948191/; classtype:trojan-activity;sid:84811291; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948188)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"58.208.147.148"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948188/; classtype:trojan-activity;sid:84811288; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948189)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.96.141.18"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948189/; classtype:trojan-activity;sid:84811289; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948190)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.55.135.64"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948190/; classtype:trojan-activity;sid:84811290; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948186)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"45.171.177.193"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948186/; classtype:trojan-activity;sid:84811286; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948187)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"210.208.110.147"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948187/; classtype:trojan-activity;sid:84811287; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948184)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.62.179.211"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948184/; classtype:trojan-activity;sid:84811284; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948185)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.155.201.217"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948185/; classtype:trojan-activity;sid:84811285; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948180)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"210.208.111.74"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948180/; classtype:trojan-activity;sid:84811280; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948181)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.58.90.151"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948181/; classtype:trojan-activity;sid:84811281; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948182)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"210.208.110.147"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948182/; classtype:trojan-activity;sid:84811282; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948183)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"210.208.110.42"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948183/; classtype:trojan-activity;sid:84811283; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948179)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"220.198.113.11"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948179/; classtype:trojan-activity;sid:84811279; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948178)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"119.114.134.132"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948178/; classtype:trojan-activity;sid:84811278; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948177)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.137.97.203"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948177/; classtype:trojan-activity;sid:84811277; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948176)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"154.242.143.151"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_12; reference:url, urlhaus.abuse.ch/url/3948176/; classtype:trojan-activity;sid:84811276; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948175)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"180.149.219.213"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948175/; classtype:trojan-activity;sid:84811275; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948173)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.15.185.45"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948173/; classtype:trojan-activity;sid:84811273; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948174)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.46.173.149"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948174/; classtype:trojan-activity;sid:84811274; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948172)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"130.0.43.154"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948172/; classtype:trojan-activity;sid:84811272; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948171)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.183.26.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948171/; classtype:trojan-activity;sid:84811271; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948170)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.114.35.23"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948170/; classtype:trojan-activity;sid:84811270; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948168)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.174.40.98"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948168/; classtype:trojan-activity;sid:84811268; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948169)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.113.25.83"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948169/; classtype:trojan-activity;sid:84811269; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948167)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.137.154.63"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948167/; classtype:trojan-activity;sid:84811267; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948166)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.137.154.63"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948166/; classtype:trojan-activity;sid:84811266; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948165)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.18.212.26"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948165/; classtype:trojan-activity;sid:84811265; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948163)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.53.135.191"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948163/; classtype:trojan-activity;sid:84811263; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948164)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"116.139.172.245"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948164/; classtype:trojan-activity;sid:84811264; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948162)"; flow:established,from_client; content:"GET"; http_method; content:"/arm5"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"176.65.139.160"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948162/; classtype:trojan-activity;sid:84811262; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948161)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.10.203.32"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948161/; classtype:trojan-activity;sid:84811261; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948160)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.234.165.238"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948160/; classtype:trojan-activity;sid:84811260; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948159)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.23.232.179"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948159/; classtype:trojan-activity;sid:84811259; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948157)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.224.140.102"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948157/; classtype:trojan-activity;sid:84811257; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948158)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.224.102.154"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948158/; classtype:trojan-activity;sid:84811258; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948156)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.235.183.249"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948156/; classtype:trojan-activity;sid:84811256; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948155)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.235.183.249"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948155/; classtype:trojan-activity;sid:84811255; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948154)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.142.204.162"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948154/; classtype:trojan-activity;sid:84811254; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948152)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.215.182.164"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948152/; classtype:trojan-activity;sid:84811252; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948153)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.13.83.188"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948153/; classtype:trojan-activity;sid:84811253; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948151)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.215.182.164"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948151/; classtype:trojan-activity;sid:84811251; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948150)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.113.225.172"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948150/; classtype:trojan-activity;sid:84811250; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948149)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.132.181.11"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948149/; classtype:trojan-activity;sid:84811249; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948148)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.11.121.151"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948148/; classtype:trojan-activity;sid:84811248; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948146)"; flow:established,from_client; content:"GET"; http_method; content:"/skid.arm"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"176.65.139.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948146/; classtype:trojan-activity;sid:84811246; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948147)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/i686"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"45.135.194.96"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948147/; classtype:trojan-activity;sid:84811247; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948143)"; flow:established,from_client; content:"GET"; http_method; content:"/mips"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"45.135.194.116"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948143/; classtype:trojan-activity;sid:84811243; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948144)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/arm6"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"45.135.194.96"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948144/; classtype:trojan-activity;sid:84811244; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948145)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/i686"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"176.65.139.209"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948145/; classtype:trojan-activity;sid:84811245; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948139)"; flow:established,from_client; content:"GET"; http_method; content:"/skid.mpsl"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"176.65.139.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948139/; classtype:trojan-activity;sid:84811239; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948140)"; flow:established,from_client; content:"GET"; http_method; content:"/skid.mips"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"176.65.139.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948140/; classtype:trojan-activity;sid:84811240; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948141)"; flow:established,from_client; content:"GET"; http_method; content:"/skid.arm7"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"176.65.139.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948141/; classtype:trojan-activity;sid:84811241; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948142)"; flow:established,from_client; content:"GET"; http_method; content:"/x86"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"176.65.139.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948142/; classtype:trojan-activity;sid:84811242; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948138)"; flow:established,from_client; content:"GET"; http_method; content:"/skid.arm5"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"176.65.139.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948138/; classtype:trojan-activity;sid:84811238; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948137)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"101.23.127.18"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948137/; classtype:trojan-activity;sid:84811237; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948136)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.157.133.197"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948136/; classtype:trojan-activity;sid:84811236; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948135)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.146.242.218"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948135/; classtype:trojan-activity;sid:84811235; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948134)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"167.250.158.32"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948134/; classtype:trojan-activity;sid:84811234; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948133)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"63.245.153.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948133/; classtype:trojan-activity;sid:84811233; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948132)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.146.242.218"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948132/; classtype:trojan-activity;sid:84811232; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948131)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.28.167.203"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948131/; classtype:trojan-activity;sid:84811231; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948130)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"157.66.146.183"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948130/; classtype:trojan-activity;sid:84811230; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948129)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"167.250.158.32"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948129/; classtype:trojan-activity;sid:84811229; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948128)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.215.127.125"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948128/; classtype:trojan-activity;sid:84811228; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948127)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.53.150.241"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948127/; classtype:trojan-activity;sid:84811227; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948126)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.226.5.161"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948126/; classtype:trojan-activity;sid:84811226; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948125)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.138.101.246"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948125/; classtype:trojan-activity;sid:84811225; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948124)"; flow:established,from_client; content:"GET"; http_method; content:"/taunahiautopatch-b7-fabric.jar"; http_uri; depth:31; isdataat:!1,relative; nocase; content:"taunahi.skyblock-qol.com"; http_host; depth:24; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948124/; classtype:trojan-activity;sid:84811224; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948122)"; flow:established,from_client; content:"GET"; http_method; content:"/curl/18r59ofv/fxv1t3fowzox6ghlb.txt"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"feed-delta.com"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948122/; classtype:trojan-activity;sid:84811222; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948123)"; flow:established,from_client; content:"GET"; http_method; content:"/f/qus5n9iecneukfdd5bqagg/8d5wkyb6"; http_uri; depth:34; isdataat:!1,relative; nocase; content:"feed-delta.com"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948123/; classtype:trojan-activity;sid:84811223; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948121)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"105.226.5.161"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948121/; classtype:trojan-activity;sid:84811221; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948120)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"180.190.188.110"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948120/; classtype:trojan-activity;sid:84811220; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948119)"; flow:established,from_client; content:"GET"; http_method; content:"/zalupa/void%20launcher.rar|3f|v=1791741131145|7c|26|7c|r=4np6h3"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"voidgame.ink"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948119/; classtype:trojan-activity;sid:84811219; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948118)"; flow:established,from_client; content:"GET"; http_method; content:"/|3f|h=110.42.232.120|7c|26|7c|p=8897|7c|26|7c|t=tcp|7c|26|7c|a=a64|7c|26|7c|stage=true|7c|26|7c|k=b41bfef6tcp"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"110.42.232.120"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948118/; classtype:trojan-activity;sid:84811218; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948117)"; flow:established,from_client; content:"GET"; http_method; content:"/|3f|h=110.42.232.120|7c|26|7c|p=8897|7c|26|7c|t=tcp|7c|26|7c|a=a32|7c|26|7c|stage=true|7c|26|7c|k=b41bfef6tcp"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"110.42.232.120"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948117/; classtype:trojan-activity;sid:84811217; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948116)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1487471200522207422/1558575558043107509/bundle.zip|3f|ex=6acbf019|7c|26|7c|is=6aca9e99|7c|26|7c|hm=e5a387311d1a09297f12483208bb35c284507fccf586bb3af5ba0a08bd441bec|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948116/; classtype:trojan-activity;sid:84811216; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948115)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1558894388057350258/1558894459301658634/bundle.zip|3f|ex=6acd1919|7c|26|7c|is=6acbc799|7c|26|7c|hm=e8e16ac6c1a60f6e2550ce451e8b078ddf3a0d35edd62abe8bd6d8c5440ded0e|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948115/; classtype:trojan-activity;sid:84811215; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948114)"; flow:established,from_client; content:"GET"; http_method; content:"/dvnx.zip"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"origin.nemoclawcloud.com"; http_host; depth:24; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948114/; classtype:trojan-activity;sid:84811214; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948113)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1555272738183061585/1558572762866389032/bundle.zip|3f|ex=6acbed7f|7c|26|7c|is=6aca9bff|7c|26|7c|hm=cb9d93f21b681de5d2665a2bf65260efd7a33c43dee7c91b58ee1d4354b66967|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948113/; classtype:trojan-activity;sid:84811213; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948112)"; flow:established,from_client; content:"GET"; http_method; content:"/download|3f|id=1tzapf8r52iwtbcfbncyiqtguikvtt9_l|7c|26|7c|export=download|7c|26|7c|authuser=0|7c|26|7c|confirm=t|7c|26|7c|uuid=1e1dd160-6170-4291-9946-3c17d14a17d7|7c|26|7c|at=amrwon1gole5aea706wpjconrpak%3a1791741732974"; http_uri; depth:221; isdataat:!1,relative; nocase; content:"drive.usercontent.google.com"; http_host; depth:28; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948112/; classtype:trojan-activity;sid:84811212; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948111)"; flow:established,from_client; content:"GET"; http_method; content:"/hashmanager64.zip"; http_uri; depth:18; isdataat:!1,relative; nocase; content:"getoutofthebackseat.com"; http_host; depth:23; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948111/; classtype:trojan-activity;sid:84811211; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948110)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.136.49.200"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948110/; classtype:trojan-activity;sid:84811210; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948108)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.55.129.129"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948108/; classtype:trojan-activity;sid:84811208; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948109)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.56.160.116"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948109/; classtype:trojan-activity;sid:84811209; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948107)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.12.25.193"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948107/; classtype:trojan-activity;sid:84811207; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948106)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.55.6.11"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948106/; classtype:trojan-activity;sid:84811206; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948105)"; flow:established,from_client; content:"GET"; http_method; content:"/divine.zip"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"immortales.fun"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948105/; classtype:trojan-activity;sid:84811205; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948104)"; flow:established,from_client; content:"GET"; http_method; content:"/divine.zip"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"wsd.immortales.fun"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948104/; classtype:trojan-activity;sid:84811204; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948103)"; flow:established,from_client; content:"GET"; http_method; content:"/discordananisikem-pixel/fenasinbasabelasin/releases/download/n/bundle.3.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948103/; classtype:trojan-activity;sid:84811203; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948102)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.53.201.33"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948102/; classtype:trojan-activity;sid:84811202; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948101)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.141.40.236"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948101/; classtype:trojan-activity;sid:84811201; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948100)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.53.201.33"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948100/; classtype:trojan-activity;sid:84811200; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948099)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.12.25.193"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948099/; classtype:trojan-activity;sid:84811199; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948097)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.9.244.39"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948097/; classtype:trojan-activity;sid:84811197; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948098)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.9.244.39"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948098/; classtype:trojan-activity;sid:84811198; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948095)"; flow:established,from_client; content:"GET"; http_method; content:"/api2.exe"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"64.235.45.196"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948095/; classtype:trojan-activity;sid:84811195; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948096)"; flow:established,from_client; content:"GET"; http_method; content:"/api.exe"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"64.235.45.196"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948096/; classtype:trojan-activity;sid:84811196; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948094)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.87.210.20"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948094/; classtype:trojan-activity;sid:84811194; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948093)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1519428468599951424/1558874277275639873/bundle.zip|3f|ex=6acd064e|7c|26|7c|is=6acbb4ce|7c|26|7c|hm=2aaf0e96bd284eb57d633f09755dbe56d43db340569798577b9bc24be9feae55|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948093/; classtype:trojan-activity;sid:84811193; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948092)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.126.109.1"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948092/; classtype:trojan-activity;sid:84811192; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948091)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.m"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.224.251.249"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948091/; classtype:trojan-activity;sid:84811191; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948090)"; flow:established,from_client; content:"GET"; http_method; content:"/f/tf5aqduh"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"87.106.233.9"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948090/; classtype:trojan-activity;sid:84811190; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948089)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.56.160.116"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948089/; classtype:trojan-activity;sid:84811189; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948088)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.55.223.24"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948088/; classtype:trojan-activity;sid:84811188; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948087)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"180.245.62.121"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948087/; classtype:trojan-activity;sid:84811187; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948086)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.189.35.172"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948086/; classtype:trojan-activity;sid:84811186; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948085)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.48.151.254"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948085/; classtype:trojan-activity;sid:84811185; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948084)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.126.109.1"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948084/; classtype:trojan-activity;sid:84811184; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948083)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.63.75.92"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948083/; classtype:trojan-activity;sid:84811183; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948082)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.13.99.50"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948082/; classtype:trojan-activity;sid:84811182; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948081)"; flow:established,from_client; content:"GET"; http_method; content:"/file/img_220945.png"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"wp.fujeigroup.com"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948081/; classtype:trojan-activity;sid:84811181; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948080)"; flow:established,from_client; content:"GET"; http_method; content:"/smmrgie.txt"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"fotoschop.cl"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948080/; classtype:trojan-activity;sid:84811180; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948076)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.142.249.70"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948076/; classtype:trojan-activity;sid:84811176; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948077)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.5.172.91"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948077/; classtype:trojan-activity;sid:84811177; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948078)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.183.2.67"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948078/; classtype:trojan-activity;sid:84811178; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948079)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"14.221.238.196"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948079/; classtype:trojan-activity;sid:84811179; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948074)"; flow:established,from_client; content:"GET"; http_method; content:"/pnct/ddnmame.txt"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"sp.negrrwe.info"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948074/; classtype:trojan-activity;sid:84811174; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948075)"; flow:established,from_client; content:"GET"; http_method; content:"/gemgvdpeix"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"rough-truth-e072.publicftpresend.workers.dev"; http_host; depth:44; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948075/; classtype:trojan-activity;sid:84811175; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948073)"; flow:established,from_client; content:"GET"; http_method; content:"/files/whisone_v3.rar"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"whisone.cc"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948073/; classtype:trojan-activity;sid:84811173; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948072)"; flow:established,from_client; content:"GET"; http_method; content:"/72img_021534.png"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"147.45.116.134"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948072/; classtype:trojan-activity;sid:84811172; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948071)"; flow:established,from_client; content:"GET"; http_method; content:"/gvaqnm.png"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"pub-53fe969c6db649fba6466eb765f54359.r2.dev"; http_host; depth:43; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948071/; classtype:trojan-activity;sid:84811171; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948070)"; flow:established,from_client; content:"GET"; http_method; content:"/zalupa/void%20launcher.rar|3f|v=1791732304860|7c|26|7c|r=0nqqux"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"voidgame.ink"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948070/; classtype:trojan-activity;sid:84811170; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948069)"; flow:established,from_client; content:"GET"; http_method; content:"/n9wyk8kgnkegd7zbt1vcvweqeakaucagrmgiv2rdhxl3gakhuzqvgeeyxqjrvjk5urvt8rvmo3bztjpeyggih0w2e4hptmw9e2v5foypiiy8s1sokwzhvt_zrosiynrmaedcwwotj6pzsfj9lfocrmz6fu3esv5b5-2r5os22xc/z4b06x88erl36fx/cs2hack.zip"; http_uri; depth:200; isdataat:!1,relative; nocase; content:"download948.mediafire.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948069/; classtype:trojan-activity;sid:84811169; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948068)"; flow:established,from_client; content:"GET"; http_method; content:"/serverpython86.exe"; http_uri; depth:19; isdataat:!1,relative; nocase; content:"filezilla.cc"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948068/; classtype:trojan-activity;sid:84811168; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948067)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.13.99.50"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948067/; classtype:trojan-activity;sid:84811167; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948066)"; flow:established,from_client; content:"GET"; http_method; content:"/ournew.exe"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"oldisgoldgameis.com"; http_host; depth:19; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948066/; classtype:trojan-activity;sid:84811166; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948065)"; flow:established,from_client; content:"GET"; http_method; content:"/download"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"anibusclientpro.netlify.app"; http_host; depth:27; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948065/; classtype:trojan-activity;sid:84811165; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948064)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.57.214.90"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948064/; classtype:trojan-activity;sid:84811164; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948063)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"117.26.82.23"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948063/; classtype:trojan-activity;sid:84811163; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948062)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.207.240.78"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948062/; classtype:trojan-activity;sid:84811162; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948061)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.179.248.208"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948061/; classtype:trojan-activity;sid:84811161; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948060)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"112.248.103.215"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948060/; classtype:trojan-activity;sid:84811160; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948059)"; flow:established,from_client; content:"GET"; http_method; content:"/chaingangs/fivem-mod-menu/-/raw/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948059/; classtype:trojan-activity;sid:84811159; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948055)"; flow:established,from_client; content:"GET"; http_method; content:"/sizzenls/umbrella-hwid-tool/raw/head/umbrella/umbrella.exe"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948055/; classtype:trojan-activity;sid:84811155; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948056)"; flow:established,from_client; content:"GET"; http_method; content:"/iceclerryk/redengine-fivem/raw/head/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948056/; classtype:trojan-activity;sid:84811156; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948057)"; flow:established,from_client; content:"GET"; http_method; content:"/lorahex/lunaexecutor/-/raw/head/lunaexecutor.zip"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948057/; classtype:trojan-activity;sid:84811157; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948058)"; flow:established,from_client; content:"GET"; http_method; content:"/fredostorm/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/head/eft_hack.zip"; http_uri; depth:116; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948058/; classtype:trojan-activity;sid:84811158; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948052)"; flow:established,from_client; content:"GET"; http_method; content:"/hantorrgess/verox-gta-enhanced/raw/head/verox.exe"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948052/; classtype:trojan-activity;sid:84811152; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948053)"; flow:established,from_client; content:"GET"; http_method; content:"/feedlixs/umbrella-hwid-tool/raw/head/umbrella/umbrella.exe"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948053/; classtype:trojan-activity;sid:84811153; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948054)"; flow:established,from_client; content:"GET"; http_method; content:"/jehhlyk/fluxus-roblox-executor/raw/head/fluxus%20v7.exe"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948054/; classtype:trojan-activity;sid:84811154; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948051)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.59.90.183"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948051/; classtype:trojan-activity;sid:84811151; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948050)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/dvr/akuma_riscv64"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948050/; classtype:trojan-activity;sid:84811150; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948049)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/dvr/akuma_sh4"; http_uri; depth:19; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948049/; classtype:trojan-activity;sid:84811149; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948048)"; flow:established,from_client; content:"GET"; http_method; content:"/divine.zip"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"fil.immortales.life"; http_host; depth:19; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948048/; classtype:trojan-activity;sid:84811148; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948047)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1557133169877192734/1558848607396823131/bundle.zip|3f|ex=6accee66|7c|26|7c|is=6acb9ce6|7c|26|7c|hm=5f09ac9e7e84a62635bc25d32c3cb27f24aa00b0c584fce284d914f93291e8ad|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948047/; classtype:trojan-activity;sid:84811147; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948043)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1540151072461553724/1558782952987562024/bundle_2.zip|3f|ex=6accb140|7c|26|7c|is=6acb5fc0|7c|26|7c|hm=f20958a51ea316ba48d7e2318eba3c39ad98f9af9c223d44fd5c761973af51a0|7c|26|7c|"; http_uri; depth:188; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948043/; classtype:trojan-activity;sid:84811143; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948044)"; flow:established,from_client; content:"GET"; http_method; content:"/11load"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"www.eyqw474.com"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948044/; classtype:trojan-activity;sid:84811144; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948045)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1554903458677653595/1558784934804725800/bundle_3.zip|3f|ex=6accb319|7c|26|7c|is=6acb6199|7c|26|7c|hm=3cc7fdd091847c025b03666b4c269e011bbcb4ab462e51e416d0006915821854|7c|26|7c|"; http_uri; depth:188; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948045/; classtype:trojan-activity;sid:84811145; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948046)"; flow:established,from_client; content:"GET"; http_method; content:"/nezha-agent"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"194.163.178.71"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948046/; classtype:trojan-activity;sid:84811146; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948040)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/dvr/akuma_m68k"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948040/; classtype:trojan-activity;sid:84811140; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948041)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/dvr/akuma_riscv32"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948041/; classtype:trojan-activity;sid:84811141; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948042)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/dvr/akuma_mips"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948042/; classtype:trojan-activity;sid:84811142; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948037)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/dvr/akuma_arm64"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948037/; classtype:trojan-activity;sid:84811137; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948038)"; flow:established,from_client; content:"GET"; http_method; content:"/mods/dupemod-26.x.jar"; http_uri; depth:22; isdataat:!1,relative; nocase; content:"mc-modhub.vercel.app"; http_host; depth:20; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948038/; classtype:trojan-activity;sid:84811138; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948039)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/dvr/akuma_i686"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948039/; classtype:trojan-activity;sid:84811139; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948036)"; flow:established,from_client; content:"GET"; http_method; content:"/enroll.sh"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"194.163.178.71"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948036/; classtype:trojan-activity;sid:84811136; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948033)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/dvr/akuma_x64"; http_uri; depth:19; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948033/; classtype:trojan-activity;sid:84811133; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948034)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"120.28.192.219"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948034/; classtype:trojan-activity;sid:84811134; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948035)"; flow:established,from_client; content:"GET"; http_method; content:"/update.sh"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"4k4iard.tupek.store"; http_host; depth:19; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948035/; classtype:trojan-activity;sid:84811135; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948028)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/dvr/akuma_mpsl"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948028/; classtype:trojan-activity;sid:84811128; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948029)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/dvr/akuma_mps64"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948029/; classtype:trojan-activity;sid:84811129; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948030)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/dvr/akuma_ppc"; http_uri; depth:19; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948030/; classtype:trojan-activity;sid:84811130; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948031)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/dvr/akuma_arm7"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948031/; classtype:trojan-activity;sid:84811131; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948032)"; flow:established,from_client; content:"GET"; http_method; content:"/donutsmpdupemod1.21.1-26.2+.jar"; http_uri; depth:32; isdataat:!1,relative; nocase; content:"donutdupe.skyblock-qol.com"; http_host; depth:26; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948032/; classtype:trojan-activity;sid:84811132; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948026)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"112.248.103.215"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948026/; classtype:trojan-activity;sid:84811126; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948025)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"124.234.0.3"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948025/; classtype:trojan-activity;sid:84811125; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948024)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"122.241.137.224"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948024/; classtype:trojan-activity;sid:84811124; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948023)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.215.82.47"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948023/; classtype:trojan-activity;sid:84811123; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948022)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.44.46.94"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948022/; classtype:trojan-activity;sid:84811122; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948021)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.117.79.167"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948021/; classtype:trojan-activity;sid:84811121; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948020)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"117.63.9.109"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948020/; classtype:trojan-activity;sid:84811120; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948019)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.108.253.24"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948019/; classtype:trojan-activity;sid:84811119; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948018)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/arm"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"45.135.194.96"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948018/; classtype:trojan-activity;sid:84811118; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948008)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sh4"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"45.135.194.96"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948008/; classtype:trojan-activity;sid:84811108; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948009)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/m68k"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"45.135.194.96"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948009/; classtype:trojan-activity;sid:84811109; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948010)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/x86"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"45.135.194.96"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948010/; classtype:trojan-activity;sid:84811110; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948011)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/ppc"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"45.135.194.96"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948011/; classtype:trojan-activity;sid:84811111; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948012)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/mips"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"45.135.194.96"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948012/; classtype:trojan-activity;sid:84811112; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948013)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/arm7"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"45.135.194.96"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948013/; classtype:trojan-activity;sid:84811113; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948014)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/x86_64"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"45.135.194.96"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948014/; classtype:trojan-activity;sid:84811114; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948015)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/arm5"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"45.135.194.96"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948015/; classtype:trojan-activity;sid:84811115; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948016)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/mpsl"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"45.135.194.96"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948016/; classtype:trojan-activity;sid:84811116; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948017)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/spc"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"45.135.194.96"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948017/; classtype:trojan-activity;sid:84811117; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948007)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/mpsl"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"176.65.139.209"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948007/; classtype:trojan-activity;sid:84811107; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948006)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.207.229.93"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948006/; classtype:trojan-activity;sid:84811106; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948005)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.117.79.167"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948005/; classtype:trojan-activity;sid:84811105; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948004)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.228.37.155"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948004/; classtype:trojan-activity;sid:84811104; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948003)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.124.205.27"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948003/; classtype:trojan-activity;sid:84811103; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948002)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"36.70.140.206"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948002/; classtype:trojan-activity;sid:84811102; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948001)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.37.231.85"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948001/; classtype:trojan-activity;sid:84811101; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3948000)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.237.253.32"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3948000/; classtype:trojan-activity;sid:84811100; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947999)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.53.220.37"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947999/; classtype:trojan-activity;sid:84811099; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947998)"; flow:established,from_client; content:"GET"; http_method; content:"/files-129312398/files/file_4aa3e284d0ae6318.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"91.92.242.236"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947998/; classtype:trojan-activity;sid:84811098; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947997)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.176.125.25"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947997/; classtype:trojan-activity;sid:84811097; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947996)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"221.235.139.104"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947996/; classtype:trojan-activity;sid:84811096; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947995)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.53.220.37"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947995/; classtype:trojan-activity;sid:84811095; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947993)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.238.168.152"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947993/; classtype:trojan-activity;sid:84811093; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947994)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.11.121.151"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947994/; classtype:trojan-activity;sid:84811094; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947992)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.9.196.5"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947992/; classtype:trojan-activity;sid:84811092; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947991)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"39.79.73.59"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947991/; classtype:trojan-activity;sid:84811091; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947990)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.45.67.66"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947990/; classtype:trojan-activity;sid:84811090; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947989)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.137.85.203"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947989/; classtype:trojan-activity;sid:84811089; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947988)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.57.184.73"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947988/; classtype:trojan-activity;sid:84811088; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947987)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.10.69.248"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947987/; classtype:trojan-activity;sid:84811087; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947986)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.6.101.155"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947986/; classtype:trojan-activity;sid:84811086; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947985)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.215.82.47"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947985/; classtype:trojan-activity;sid:84811085; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947984)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.215.122.210"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947984/; classtype:trojan-activity;sid:84811084; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947983)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"37.28.177.69"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947983/; classtype:trojan-activity;sid:84811083; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947982)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.239.255.151"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947982/; classtype:trojan-activity;sid:84811082; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947981)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.190.69.149"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947981/; classtype:trojan-activity;sid:84811081; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947979)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"216.249.4.20"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947979/; classtype:trojan-activity;sid:84811079; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947980)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"218.28.150.23"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947980/; classtype:trojan-activity;sid:84811080; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947978)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"196.189.96.59"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947978/; classtype:trojan-activity;sid:84811078; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947976)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.121.221.214"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947976/; classtype:trojan-activity;sid:84811076; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947977)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.226.66.182"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947977/; classtype:trojan-activity;sid:84811077; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947975)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"103.125.31.101"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947975/; classtype:trojan-activity;sid:84811075; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947973)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.121.82.228"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947973/; classtype:trojan-activity;sid:84811073; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947974)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.121.82.228"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947974/; classtype:trojan-activity;sid:84811074; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947972)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.56.3.241"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947972/; classtype:trojan-activity;sid:84811072; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947971)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.119.254.104"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947971/; classtype:trojan-activity;sid:84811071; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947969)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.117.127.133"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947969/; classtype:trojan-activity;sid:84811069; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947970)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"103.172.186.170"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947970/; classtype:trojan-activity;sid:84811070; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947968)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.84.214.107"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947968/; classtype:trojan-activity;sid:84811068; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947967)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.231.111.124"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947967/; classtype:trojan-activity;sid:84811067; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947966)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"165.98.243.83"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947966/; classtype:trojan-activity;sid:84811066; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947965)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.117.127.133"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947965/; classtype:trojan-activity;sid:84811065; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947962)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"179.49.213.85"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947962/; classtype:trojan-activity;sid:84811062; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947963)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.117.76.135"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947963/; classtype:trojan-activity;sid:84811063; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947964)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.113.203.175"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947964/; classtype:trojan-activity;sid:84811064; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947961)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.55.236.179"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947961/; classtype:trojan-activity;sid:84811061; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947960)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.47.224.254"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947960/; classtype:trojan-activity;sid:84811060; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947959)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.231.111.124"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947959/; classtype:trojan-activity;sid:84811059; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947958)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.5.14.37"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947958/; classtype:trojan-activity;sid:84811058; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947957)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"113.230.23.74"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947957/; classtype:trojan-activity;sid:84811057; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947956)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.231.217.129"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947956/; classtype:trojan-activity;sid:84811056; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947952)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.185.222.129"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947952/; classtype:trojan-activity;sid:84811052; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947953)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.40.158.82"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947953/; classtype:trojan-activity;sid:84811053; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947954)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.46.173.149"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947954/; classtype:trojan-activity;sid:84811054; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947955)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.14.122.226"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947955/; classtype:trojan-activity;sid:84811055; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947950)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.44.46.94"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947950/; classtype:trojan-activity;sid:84811050; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947951)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.47.224.254"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947951/; classtype:trojan-activity;sid:84811051; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947949)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"113.231.217.129"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947949/; classtype:trojan-activity;sid:84811049; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947948)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"210.208.111.36"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947948/; classtype:trojan-activity;sid:84811048; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947946)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.97.251.62"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947946/; classtype:trojan-activity;sid:84811046; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947947)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"202.110.28.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947947/; classtype:trojan-activity;sid:84811047; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947945)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.53.15.189"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947945/; classtype:trojan-activity;sid:84811045; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947944)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.115.164.178"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947944/; classtype:trojan-activity;sid:84811044; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947943)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.139.101.75"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947943/; classtype:trojan-activity;sid:84811043; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947942)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.233.104.85"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947942/; classtype:trojan-activity;sid:84811042; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947941)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/arm7"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"38.253.224.56"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947941/; classtype:trojan-activity;sid:84811041; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947940)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.224.251.249"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947940/; classtype:trojan-activity;sid:84811040; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947939)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"85.12.205.35"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947939/; classtype:trojan-activity;sid:84811039; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947938)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"85.12.205.35"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947938/; classtype:trojan-activity;sid:84811038; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947937)"; flow:established,from_client; content:"GET"; http_method; content:"/armv5l"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"45.135.194.116"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947937/; classtype:trojan-activity;sid:84811037; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947933)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.ppc"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"185.221.222.175"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947933/; classtype:trojan-activity;sid:84811033; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947934)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.arm5"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"185.221.222.175"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947934/; classtype:trojan-activity;sid:84811034; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947935)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.spc"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"185.221.222.175"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947935/; classtype:trojan-activity;sid:84811035; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947936)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.mpsl"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"185.221.222.175"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947936/; classtype:trojan-activity;sid:84811036; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947928)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.arm7"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"185.221.222.175"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947928/; classtype:trojan-activity;sid:84811028; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947929)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.m68k"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"185.221.222.175"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947929/; classtype:trojan-activity;sid:84811029; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947930)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.sh4"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"185.221.222.175"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947930/; classtype:trojan-activity;sid:84811030; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947931)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.mips"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"185.221.222.175"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947931/; classtype:trojan-activity;sid:84811031; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947932)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.arm6"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"185.221.222.175"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947932/; classtype:trojan-activity;sid:84811032; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947926)"; flow:established,from_client; content:"GET"; http_method; content:"/m68k"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"45.135.194.116"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947926/; classtype:trojan-activity;sid:84811026; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947927)"; flow:established,from_client; content:"GET"; http_method; content:"/armv6l"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"45.135.194.116"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947927/; classtype:trojan-activity;sid:84811027; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947920)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.55.7.254"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947920/; classtype:trojan-activity;sid:84811020; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947921)"; flow:established,from_client; content:"GET"; http_method; content:"/powerpc"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"45.135.194.116"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947921/; classtype:trojan-activity;sid:84811021; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947922)"; flow:established,from_client; content:"GET"; http_method; content:"/mipsel"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"45.135.194.116"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947922/; classtype:trojan-activity;sid:84811022; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947923)"; flow:established,from_client; content:"GET"; http_method; content:"/armv4l"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"45.135.194.116"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947923/; classtype:trojan-activity;sid:84811023; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947924)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/mpsl"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"94.154.43.37"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947924/; classtype:trojan-activity;sid:84811024; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947925)"; flow:established,from_client; content:"GET"; http_method; content:"/armv7l"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"45.135.194.116"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947925/; classtype:trojan-activity;sid:84811025; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947919)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.49.203.91"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947919/; classtype:trojan-activity;sid:84811019; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947918)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"180.191.16.24"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947918/; classtype:trojan-activity;sid:84811018; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947917)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"119.115.164.178"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947917/; classtype:trojan-activity;sid:84811017; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947916)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"119.115.254.82"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947916/; classtype:trojan-activity;sid:84811016; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947915)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"219.155.237.46"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947915/; classtype:trojan-activity;sid:84811015; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947914)"; flow:established,from_client; content:"GET"; http_method; content:"/arm6"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"5.175.222.237"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947914/; classtype:trojan-activity;sid:84811014; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947907)"; flow:established,from_client; content:"GET"; http_method; content:"/s5_amd64"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947907/; classtype:trojan-activity;sid:84811007; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947908)"; flow:established,from_client; content:"GET"; http_method; content:"/s5_armv7"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947908/; classtype:trojan-activity;sid:84811008; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947909)"; flow:established,from_client; content:"GET"; http_method; content:"/svc-helper-arm"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947909/; classtype:trojan-activity;sid:84811009; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947910)"; flow:established,from_client; content:"GET"; http_method; content:"/nodetap_amd64"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947910/; classtype:trojan-activity;sid:84811010; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947911)"; flow:established,from_client; content:"GET"; http_method; content:"/reports.json"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947911/; classtype:trojan-activity;sid:84811011; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947912)"; flow:established,from_client; content:"GET"; http_method; content:"/s5test"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947912/; classtype:trojan-activity;sid:84811012; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947913)"; flow:established,from_client; content:"GET"; http_method; content:"/chisel-amd64"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947913/; classtype:trojan-activity;sid:84811013; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947906)"; flow:established,from_client; content:"GET"; http_method; content:"/s5-armv5.gz"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947906/; classtype:trojan-activity;sid:84811006; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947905)"; flow:established,from_client; content:"GET"; http_method; content:"/w8001.json"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947905/; classtype:trojan-activity;sid:84811005; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947901)"; flow:established,from_client; content:"GET"; http_method; content:"/zero.mips"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"5.175.222.237"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947901/; classtype:trojan-activity;sid:84811001; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947902)"; flow:established,from_client; content:"GET"; http_method; content:"/ruck"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"5.175.222.237"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947902/; classtype:trojan-activity;sid:84811002; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947903)"; flow:established,from_client; content:"GET"; http_method; content:"/zero.arm5"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"5.175.222.237"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947903/; classtype:trojan-activity;sid:84811003; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947904)"; flow:established,from_client; content:"GET"; http_method; content:"/ipc"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"5.175.222.237"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947904/; classtype:trojan-activity;sid:84811004; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947898)"; flow:established,from_client; content:"GET"; http_method; content:"/m68k"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"5.175.222.237"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947898/; classtype:trojan-activity;sid:84810998; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947899)"; flow:established,from_client; content:"GET"; http_method; content:"/sdt"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"5.175.222.237"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947899/; classtype:trojan-activity;sid:84810999; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947900)"; flow:established,from_client; content:"GET"; http_method; content:"/irz"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"5.175.222.237"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947900/; classtype:trojan-activity;sid:84811000; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947897)"; flow:established,from_client; content:"GET"; http_method; content:"/ppc"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"5.175.222.237"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947897/; classtype:trojan-activity;sid:84810997; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947896)"; flow:established,from_client; content:"GET"; http_method; content:"/zero.arm7"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"5.175.222.237"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947896/; classtype:trojan-activity;sid:84810996; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947894)"; flow:established,from_client; content:"GET"; http_method; content:"/sh4"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"5.175.222.237"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947894/; classtype:trojan-activity;sid:84810994; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947895)"; flow:established,from_client; content:"GET"; http_method; content:"/vc"; http_uri; depth:3; isdataat:!1,relative; nocase; content:"5.175.222.237"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947895/; classtype:trojan-activity;sid:84810995; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947893)"; flow:established,from_client; content:"GET"; http_method; content:"/spc"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"5.175.222.237"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947893/; classtype:trojan-activity;sid:84810993; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947885)"; flow:established,from_client; content:"GET"; http_method; content:"/fdgsfg"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"5.175.222.237"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947885/; classtype:trojan-activity;sid:84810985; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947886)"; flow:established,from_client; content:"GET"; http_method; content:"/mips"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"5.175.222.237"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947886/; classtype:trojan-activity;sid:84810986; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947887)"; flow:established,from_client; content:"GET"; http_method; content:"/zero.arm"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"5.175.222.237"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947887/; classtype:trojan-activity;sid:84810987; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947888)"; flow:established,from_client; content:"GET"; http_method; content:"/mpsl"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"5.175.222.237"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947888/; classtype:trojan-activity;sid:84810988; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947889)"; flow:established,from_client; content:"GET"; http_method; content:"/arm7"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"5.175.222.237"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947889/; classtype:trojan-activity;sid:84810989; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947890)"; flow:established,from_client; content:"GET"; http_method; content:"/aaa"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"5.175.222.237"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947890/; classtype:trojan-activity;sid:84810990; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947891)"; flow:established,from_client; content:"GET"; http_method; content:"/gocl"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"5.175.222.237"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947891/; classtype:trojan-activity;sid:84810991; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947892)"; flow:established,from_client; content:"GET"; http_method; content:"/zz"; http_uri; depth:3; isdataat:!1,relative; nocase; content:"5.175.222.237"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947892/; classtype:trojan-activity;sid:84810992; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947882)"; flow:established,from_client; content:"GET"; http_method; content:"/arm"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"5.175.222.237"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947882/; classtype:trojan-activity;sid:84810982; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947883)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.x86_debug"; http_uri; depth:18; isdataat:!1,relative; nocase; content:"77.90.14.60"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947883/; classtype:trojan-activity;sid:84810983; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947884)"; flow:established,from_client; content:"GET"; http_method; content:"/arm5"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"5.175.222.237"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947884/; classtype:trojan-activity;sid:84810984; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947877)"; flow:established,from_client; content:"GET"; http_method; content:"/s5_arm64"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947877/; classtype:trojan-activity;sid:84810977; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947878)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.sh4"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"103.170.217.170"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947878/; classtype:trojan-activity;sid:84810978; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947879)"; flow:established,from_client; content:"GET"; http_method; content:"/svc-helper-mips"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947879/; classtype:trojan-activity;sid:84810979; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947880)"; flow:established,from_client; content:"GET"; http_method; content:"/s5_armv5_v2"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947880/; classtype:trojan-activity;sid:84810980; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947881)"; flow:established,from_client; content:"GET"; http_method; content:"/s5_arm64_v2"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947881/; classtype:trojan-activity;sid:84810981; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947874)"; flow:established,from_client; content:"GET"; http_method; content:"/team-ok.json"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947874/; classtype:trojan-activity;sid:84810974; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947875)"; flow:established,from_client; content:"GET"; http_method; content:"/klogd_mipsel_static"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947875/; classtype:trojan-activity;sid:84810975; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947876)"; flow:established,from_client; content:"GET"; http_method; content:"/svc-helper-mipsel"; http_uri; depth:18; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947876/; classtype:trojan-activity;sid:84810976; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947870)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/x86_64"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"38.253.224.56"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947870/; classtype:trojan-activity;sid:84810970; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947871)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.mpsel"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"103.170.217.170"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947871/; classtype:trojan-activity;sid:84810971; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947872)"; flow:established,from_client; content:"GET"; http_method; content:"/s5_armv5"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947872/; classtype:trojan-activity;sid:84810972; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947873)"; flow:established,from_client; content:"GET"; http_method; content:"/s5_amd64_v2"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947873/; classtype:trojan-activity;sid:84810973; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947860)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/bot.x86_64"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"38.253.224.56"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947860/; classtype:trojan-activity;sid:84810960; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947861)"; flow:established,from_client; content:"GET"; http_method; content:"/s5_386"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947861/; classtype:trojan-activity;sid:84810961; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947862)"; flow:established,from_client; content:"GET"; http_method; content:"/s5-armv7.gz"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947862/; classtype:trojan-activity;sid:84810962; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947863)"; flow:established,from_client; content:"GET"; http_method; content:"/s5_mipsle"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947863/; classtype:trojan-activity;sid:84810963; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947864)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/telnet/akuma_x64"; http_uri; depth:22; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947864/; classtype:trojan-activity;sid:84810964; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947865)"; flow:established,from_client; content:"GET"; http_method; content:"/svc-helper-x86_64"; http_uri; depth:18; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947865/; classtype:trojan-activity;sid:84810965; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947866)"; flow:established,from_client; content:"GET"; http_method; content:"/s5_386_v2"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947866/; classtype:trojan-activity;sid:84810966; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947867)"; flow:established,from_client; content:"GET"; http_method; content:"/nodetap_v2"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947867/; classtype:trojan-activity;sid:84810967; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947868)"; flow:established,from_client; content:"GET"; http_method; content:"/map.json"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947868/; classtype:trojan-activity;sid:84810968; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947869)"; flow:established,from_client; content:"GET"; http_method; content:"/s5_mipsle_v2"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947869/; classtype:trojan-activity;sid:84810969; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947852)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.m68k"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"103.170.217.170"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947852/; classtype:trojan-activity;sid:84810952; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947853)"; flow:established,from_client; content:"GET"; http_method; content:"/socks5.pl"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947853/; classtype:trojan-activity;sid:84810953; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947854)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.arm6"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"103.170.217.170"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947854/; classtype:trojan-activity;sid:84810954; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947855)"; flow:established,from_client; content:"GET"; http_method; content:"/s5-linux-armv7"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947855/; classtype:trojan-activity;sid:84810955; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947856)"; flow:established,from_client; content:"GET"; http_method; content:"/f/9ksbxnvwoj7pts0uxop4sa/01pemlfd"; http_uri; depth:34; isdataat:!1,relative; nocase; content:"fable-shine.com"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947856/; classtype:trojan-activity;sid:84810956; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947857)"; flow:established,from_client; content:"GET"; http_method; content:"/s5_mips"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947857/; classtype:trojan-activity;sid:84810957; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947858)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.ppc"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"103.170.217.170"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947858/; classtype:trojan-activity;sid:84810958; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947859)"; flow:established,from_client; content:"GET"; http_method; content:"/s5_mips_v2"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947859/; classtype:trojan-activity;sid:84810959; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947851)"; flow:established,from_client; content:"GET"; http_method; content:"/svc-helper-aarch64"; http_uri; depth:19; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947851/; classtype:trojan-activity;sid:84810951; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947847)"; flow:established,from_client; content:"GET"; http_method; content:"/es02_key"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947847/; classtype:trojan-activity;sid:84810947; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947848)"; flow:established,from_client; content:"GET"; http_method; content:"/es02_key.pub"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947848/; classtype:trojan-activity;sid:84810948; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947849)"; flow:established,from_client; content:"GET"; http_method; content:"/.ch.b64"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947849/; classtype:trojan-activity;sid:84810949; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947850)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.arm4"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"103.170.217.170"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947850/; classtype:trojan-activity;sid:84810950; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947844)"; flow:established,from_client; content:"GET"; http_method; content:"/sv2"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947844/; classtype:trojan-activity;sid:84810944; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947845)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.arm5"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"103.170.217.170"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947845/; classtype:trojan-activity;sid:84810945; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947846)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.arm7"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"103.170.217.170"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947846/; classtype:trojan-activity;sid:84810946; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947840)"; flow:established,from_client; content:"GET"; http_method; content:"/curl/g0xsutkb0/iwsnry04os3w6i7z3ufc.dat"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"fable-shine.com"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947840/; classtype:trojan-activity;sid:84810940; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947841)"; flow:established,from_client; content:"GET"; http_method; content:"/pre_reinstall_checklist.md"; http_uri; depth:27; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947841/; classtype:trojan-activity;sid:84810941; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947842)"; flow:established,from_client; content:"GET"; http_method; content:"/s5-linux-amd64"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947842/; classtype:trojan-activity;sid:84810942; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947843)"; flow:established,from_client; content:"GET"; http_method; content:"/disabled_migrated/"; http_uri; depth:19; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947843/; classtype:trojan-activity;sid:84810943; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947839)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1555272738183061585/1558557133245780058/bundle.zip|3f|ex=6acbdef1|7c|26|7c|is=6aca8d71|7c|26|7c|hm=8daaf74111ef8826e79aab5a6931905012f0acbe8b1164f6a3209b1474b38780|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947839/; classtype:trojan-activity;sid:84810939; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947838)"; flow:established,from_client; content:"GET"; http_method; content:"/scl/fi/ovgcqrqvo601c4xrgrsso/bundle.zip|3f|rlkey=jpo47d62rtkevfrwz5yfsx93x|7c|26|7c|st=ic2dii77|7c|26|7c|dl=1"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"www.dropbox.com"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947838/; classtype:trojan-activity;sid:84810938; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947837)"; flow:established,from_client; content:"GET"; http_method; content:"/u/x7k9m2/wget.sh"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"176.65.139.231"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947837/; classtype:trojan-activity;sid:84810937; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947835)"; flow:established,from_client; content:"GET"; http_method; content:"/sora.sh"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"103.170.217.170"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947835/; classtype:trojan-activity;sid:84810935; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947836)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.m"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"45.2.24.40"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947836/; classtype:trojan-activity;sid:84810936; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947833)"; flow:established,from_client; content:"GET"; http_method; content:"/ront"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"65.87.7.90"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947833/; classtype:trojan-activity;sid:84810933; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947834)"; flow:established,from_client; content:"GET"; http_method; content:"/in"; http_uri; depth:3; isdataat:!1,relative; nocase; content:"65.87.7.90"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947834/; classtype:trojan-activity;sid:84810934; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947829)"; flow:established,from_client; content:"GET"; http_method; content:"/|3f|download=1"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"videdtp-rus.vercel.app"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947829/; classtype:trojan-activity;sid:84810929; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947830)"; flow:established,from_client; content:"GET"; http_method; content:"/brazzers.msi"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"blaze-x.com"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947830/; classtype:trojan-activity;sid:84810930; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947831)"; flow:established,from_client; content:"GET"; http_method; content:"/spinrain/warzoneexternalcheat/-/raw/head/loader.exe"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947831/; classtype:trojan-activity;sid:84810931; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947832)"; flow:established,from_client; content:"GET"; http_method; content:"/sora.sh"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"209.99.184.98"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947832/; classtype:trojan-activity;sid:84810932; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947827)"; flow:established,from_client; content:"GET"; http_method; content:"/downshifts/valorantexternalcheat/-/raw/head/loader.exe"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947827/; classtype:trojan-activity;sid:84810927; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947828)"; flow:established,from_client; content:"GET"; http_method; content:"/grizzlebugg/monotone-hwid-spoofer/-/raw/head/monotone-hwid-spoofer-master.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947828/; classtype:trojan-activity;sid:84810928; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947826)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.m"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"201.159.91.2"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947826/; classtype:trojan-activity;sid:84810926; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947825)"; flow:established,from_client; content:"GET"; http_method; content:"/aintsmash/roblox-script-executor/raw/head/wave.exe"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947825/; classtype:trojan-activity;sid:84810925; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947821)"; flow:established,from_client; content:"GET"; http_method; content:"/ora23.sh"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"173.255.247.97"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947821/; classtype:trojan-activity;sid:84810921; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947822)"; flow:established,from_client; content:"GET"; http_method; content:"/csgo.exe"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"174.138.21.29"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947822/; classtype:trojan-activity;sid:84810922; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947823)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.x86"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"103.170.217.170"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947823/; classtype:trojan-activity;sid:84810923; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947824)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.mips"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"103.170.217.170"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947824/; classtype:trojan-activity;sid:84810924; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947819)"; flow:established,from_client; content:"GET"; http_method; content:"/x86_64"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"45.135.194.116"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947819/; classtype:trojan-activity;sid:84810919; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947820)"; flow:established,from_client; content:"GET"; http_method; content:"/tracc1vs/fortniteexternalcheat/raw/head/loader.exe"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947820/; classtype:trojan-activity;sid:84810920; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947814)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.x86"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"209.99.184.98"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947814/; classtype:trojan-activity;sid:84810914; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947815)"; flow:established,from_client; content:"GET"; http_method; content:"/fs.tgz"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"65.87.7.90"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947815/; classtype:trojan-activity;sid:84810915; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947816)"; flow:established,from_client; content:"GET"; http_method; content:"/t/cmd.txt"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"212.83.160.70"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947816/; classtype:trojan-activity;sid:84810916; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947817)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.mips"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"209.99.184.98"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947817/; classtype:trojan-activity;sid:84810917; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947818)"; flow:established,from_client; content:"GET"; http_method; content:"/fsa.tgz"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"65.87.7.90"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947818/; classtype:trojan-activity;sid:84810918; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947813)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"221.1.246.222"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947813/; classtype:trojan-activity;sid:84810913; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947812)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"119.166.65.199"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947812/; classtype:trojan-activity;sid:84810912; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947810)"; flow:established,from_client; content:"GET"; http_method; content:"/x64s-l7"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"176.65.139.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947810/; classtype:trojan-activity;sid:84810910; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947811)"; flow:established,from_client; content:"GET"; http_method; content:"/armv7-l7"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"176.65.139.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947811/; classtype:trojan-activity;sid:84810911; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947805)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.arm6"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"209.99.184.98"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947805/; classtype:trojan-activity;sid:84810905; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947806)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.arm5"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"209.99.184.98"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947806/; classtype:trojan-activity;sid:84810906; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947807)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.arm7"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"209.99.184.98"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947807/; classtype:trojan-activity;sid:84810907; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947808)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.mpsl"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"209.99.184.98"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947808/; classtype:trojan-activity;sid:84810908; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947809)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.mpsl"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"103.170.217.170"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947809/; classtype:trojan-activity;sid:84810909; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947801)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.ppc"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"209.99.184.98"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947801/; classtype:trojan-activity;sid:84810901; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947802)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.m68k"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"209.99.184.98"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947802/; classtype:trojan-activity;sid:84810902; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947803)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.sh4"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"209.99.184.98"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947803/; classtype:trojan-activity;sid:84810903; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947804)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.arm4"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"209.99.184.98"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947804/; classtype:trojan-activity;sid:84810904; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947799)"; flow:established,from_client; content:"GET"; http_method; content:"/files-129312398/files/file_ae7a11e6661db689.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"91.92.242.236"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947799/; classtype:trojan-activity;sid:84810899; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947800)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.10.230.10"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947800/; classtype:trojan-activity;sid:84810900; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947798)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.28.215.129"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947798/; classtype:trojan-activity;sid:84810898; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947797)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.233.104.85"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947797/; classtype:trojan-activity;sid:84810897; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947796)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.121.185.4"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947796/; classtype:trojan-activity;sid:84810896; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947795)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.121.185.4"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947795/; classtype:trojan-activity;sid:84810895; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947794)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"112.229.207.15"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947794/; classtype:trojan-activity;sid:84810894; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947793)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"202.1.26.13"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947793/; classtype:trojan-activity;sid:84810893; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947792)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.43.54.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947792/; classtype:trojan-activity;sid:84810892; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947791)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"120.84.212.206"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947791/; classtype:trojan-activity;sid:84810891; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947790)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.231.65.187"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947790/; classtype:trojan-activity;sid:84810890; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947787)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"151.234.36.221"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947787/; classtype:trojan-activity;sid:84810887; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947788)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.45.67.66"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947788/; classtype:trojan-activity;sid:84810888; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947789)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"124.6.169.54"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947789/; classtype:trojan-activity;sid:84810889; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947786)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"124.234.246.166"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947786/; classtype:trojan-activity;sid:84810886; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947785)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.149.67.216"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947785/; classtype:trojan-activity;sid:84810885; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947784)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.117.163.106"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947784/; classtype:trojan-activity;sid:84810884; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947783)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.11.179.154"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947783/; classtype:trojan-activity;sid:84810883; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947782)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.139.67.114"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947782/; classtype:trojan-activity;sid:84810882; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947781)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.63.14.84"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947781/; classtype:trojan-activity;sid:84810881; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947780)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"210.208.110.21"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947780/; classtype:trojan-activity;sid:84810880; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947779)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.127.71.141"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947779/; classtype:trojan-activity;sid:84810879; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947777)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.115.254.82"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947777/; classtype:trojan-activity;sid:84810877; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947778)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.127.53.189"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947778/; classtype:trojan-activity;sid:84810878; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947776)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.117.151.7"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947776/; classtype:trojan-activity;sid:84810876; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947775)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.113.206.103"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947775/; classtype:trojan-activity;sid:84810875; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947774)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.117.163.106"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947774/; classtype:trojan-activity;sid:84810874; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947773)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.117.31.73"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947773/; classtype:trojan-activity;sid:84810873; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947772)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"216.126.74.218"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947772/; classtype:trojan-activity;sid:84810872; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947771)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.141.73.146"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947771/; classtype:trojan-activity;sid:84810871; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947770)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"117.63.227.203"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947770/; classtype:trojan-activity;sid:84810870; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947769)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.19.222.107"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947769/; classtype:trojan-activity;sid:84810869; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947768)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.204.199.141"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947768/; classtype:trojan-activity;sid:84810868; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947767)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"85.185.55.80"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947767/; classtype:trojan-activity;sid:84810867; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947766)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.137.77.98"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947766/; classtype:trojan-activity;sid:84810866; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947765)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"85.185.55.80"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947765/; classtype:trojan-activity;sid:84810865; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947764)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.166.65.199"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947764/; classtype:trojan-activity;sid:84810864; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947763)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.137.97.203"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947763/; classtype:trojan-activity;sid:84810863; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947762)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.7.227.193"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947762/; classtype:trojan-activity;sid:84810862; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947760)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.57.239.216"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947760/; classtype:trojan-activity;sid:84810860; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947761)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.121.185.230"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947761/; classtype:trojan-activity;sid:84810861; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947759)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.96.138.194"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947759/; classtype:trojan-activity;sid:84810859; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947758)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.7.227.193"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947758/; classtype:trojan-activity;sid:84810858; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947757)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.180.159.4"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947757/; classtype:trojan-activity;sid:84810857; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947756)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.113.203.175"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947756/; classtype:trojan-activity;sid:84810856; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947755)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.5.190.28"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947755/; classtype:trojan-activity;sid:84810855; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947754)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.206.97.32"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947754/; classtype:trojan-activity;sid:84810854; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947752)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.55.31.152"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947752/; classtype:trojan-activity;sid:84810852; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947753)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.55.236.179"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947753/; classtype:trojan-activity;sid:84810853; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947751)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.59.247.94"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947751/; classtype:trojan-activity;sid:84810851; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947750)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"218.24.252.208"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947750/; classtype:trojan-activity;sid:84810850; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947749)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.5.190.28"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947749/; classtype:trojan-activity;sid:84810849; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947746)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.151.180.248"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947746/; classtype:trojan-activity;sid:84810846; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947747)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"180.191.16.24"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947747/; classtype:trojan-activity;sid:84810847; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947748)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.55.31.152"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947748/; classtype:trojan-activity;sid:84810848; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947745)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.239.189.168"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947745/; classtype:trojan-activity;sid:84810845; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947744)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.34.61.7"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947744/; classtype:trojan-activity;sid:84810844; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947743)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.123.208.160"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947743/; classtype:trojan-activity;sid:84810843; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947741)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.127.125.96"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947741/; classtype:trojan-activity;sid:84810841; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947742)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.57.239.216"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947742/; classtype:trojan-activity;sid:84810842; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947740)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.127.70.192"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_11; reference:url, urlhaus.abuse.ch/url/3947740/; classtype:trojan-activity;sid:84810840; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947739)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.62.177.67"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947739/; classtype:trojan-activity;sid:84810839; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947738)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"113.206.97.32"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947738/; classtype:trojan-activity;sid:84810838; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947736)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"202.1.26.13"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947736/; classtype:trojan-activity;sid:84810836; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947737)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"82.114.178.6"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947737/; classtype:trojan-activity;sid:84810837; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947735)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"95.237.154.159"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947735/; classtype:trojan-activity;sid:84810835; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947734)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.24.126.151"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947734/; classtype:trojan-activity;sid:84810834; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947733)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.157.39.4"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947733/; classtype:trojan-activity;sid:84810833; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947732)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"103.125.31.101"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947732/; classtype:trojan-activity;sid:84810832; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947731)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.126.90.240"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947731/; classtype:trojan-activity;sid:84810831; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947730)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.215.89.229"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947730/; classtype:trojan-activity;sid:84810830; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947729)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.126.90.240"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947729/; classtype:trojan-activity;sid:84810829; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947728)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.49.75.50"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947728/; classtype:trojan-activity;sid:84810828; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947727)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.166.241.219"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947727/; classtype:trojan-activity;sid:84810827; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947724)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.55.7.254"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947724/; classtype:trojan-activity;sid:84810824; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947725)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.96.141.125"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947725/; classtype:trojan-activity;sid:84810825; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947726)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.74.47.206"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947726/; classtype:trojan-activity;sid:84810826; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947723)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.189.96.59"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947723/; classtype:trojan-activity;sid:84810823; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947722)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.116.34.137"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947722/; classtype:trojan-activity;sid:84810822; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947721)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.49.75.50"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947721/; classtype:trojan-activity;sid:84810821; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947720)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.56.181.20"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947720/; classtype:trojan-activity;sid:84810820; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947717)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.56.157.201"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947717/; classtype:trojan-activity;sid:84810817; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947718)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"203.177.251.31"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947718/; classtype:trojan-activity;sid:84810818; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947719)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"201.110.101.29"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947719/; classtype:trojan-activity;sid:84810819; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947716)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"119.166.241.219"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947716/; classtype:trojan-activity;sid:84810816; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947715)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"94.67.152.120"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947715/; classtype:trojan-activity;sid:84810815; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947714)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.57.194.125"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947714/; classtype:trojan-activity;sid:84810814; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947713)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"94.67.152.120"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947713/; classtype:trojan-activity;sid:84810813; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947712)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.52.233.42"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947712/; classtype:trojan-activity;sid:84810812; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947711)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.138.150.84"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947711/; classtype:trojan-activity;sid:84810811; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947710)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.202.71.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947710/; classtype:trojan-activity;sid:84810810; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947709)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.54.41.100"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947709/; classtype:trojan-activity;sid:84810809; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947708)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.58.179.240"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947708/; classtype:trojan-activity;sid:84810808; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947707)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.56.140.178"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947707/; classtype:trojan-activity;sid:84810807; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947706)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"146.66.249.137"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947706/; classtype:trojan-activity;sid:84810806; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947705)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.57.60.50"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947705/; classtype:trojan-activity;sid:84810805; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947704)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.55.129.129"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947704/; classtype:trojan-activity;sid:84810804; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947703)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.139.44.122"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947703/; classtype:trojan-activity;sid:84810803; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947702)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.63.148.118"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947702/; classtype:trojan-activity;sid:84810802; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947701)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.44.147.91"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947701/; classtype:trojan-activity;sid:84810801; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947700)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.224.251.249"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947700/; classtype:trojan-activity;sid:84810800; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947699)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"46.236.65.235"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947699/; classtype:trojan-activity;sid:84810799; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947698)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.55.6.11"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947698/; classtype:trojan-activity;sid:84810798; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947697)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.233.253.2"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947697/; classtype:trojan-activity;sid:84810797; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947695)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"103.70.165.181"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947695/; classtype:trojan-activity;sid:84810795; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947696)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.58.179.240"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947696/; classtype:trojan-activity;sid:84810796; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947694)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.150.176.206"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947694/; classtype:trojan-activity;sid:84810794; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947693)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"116.207.223.13"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947693/; classtype:trojan-activity;sid:84810793; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947692)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"46.159.162.92"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947692/; classtype:trojan-activity;sid:84810792; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947691)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.61.115.27"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947691/; classtype:trojan-activity;sid:84810791; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947690)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.233.198.83"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947690/; classtype:trojan-activity;sid:84810790; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947689)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"58.22.19.96"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947689/; classtype:trojan-activity;sid:84810789; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947688)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.6.56.231"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947688/; classtype:trojan-activity;sid:84810788; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947687)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.121.156.64"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947687/; classtype:trojan-activity;sid:84810787; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947685)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.99.114.27"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947685/; classtype:trojan-activity;sid:84810785; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947686)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.57.202.127"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947686/; classtype:trojan-activity;sid:84810786; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947684)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"112.248.141.165"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947684/; classtype:trojan-activity;sid:84810784; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947683)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.230.23.140"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947683/; classtype:trojan-activity;sid:84810783; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947682)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.9.193.142"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947682/; classtype:trojan-activity;sid:84810782; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947681)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.99.114.27"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947681/; classtype:trojan-activity;sid:84810781; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947680)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.4.178.130"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947680/; classtype:trojan-activity;sid:84810780; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947679)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"116.138.218.96"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947679/; classtype:trojan-activity;sid:84810779; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947678)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.63.14.230"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947678/; classtype:trojan-activity;sid:84810778; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947677)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.55.55.172"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947677/; classtype:trojan-activity;sid:84810777; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947676)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.4.178.130"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947676/; classtype:trojan-activity;sid:84810776; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947672)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"176.239.8.108"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947672/; classtype:trojan-activity;sid:84810772; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947673)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.113.206.103"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947673/; classtype:trojan-activity;sid:84810773; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947674)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"210.97.100.192"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947674/; classtype:trojan-activity;sid:84810774; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947675)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"176.239.8.108"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947675/; classtype:trojan-activity;sid:84810775; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947671)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.189.35.226"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947671/; classtype:trojan-activity;sid:84810771; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947669)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.19.228.107"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947669/; classtype:trojan-activity;sid:84810769; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947670)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.46.215.233"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947670/; classtype:trojan-activity;sid:84810770; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947668)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"61.52.230.84"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947668/; classtype:trojan-activity;sid:84810768; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947666)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.5.126.90"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947666/; classtype:trojan-activity;sid:84810766; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947667)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"120.28.195.161"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947667/; classtype:trojan-activity;sid:84810767; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947664)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"119.179.238.153"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947664/; classtype:trojan-activity;sid:84810764; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947665)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"109.97.45.66"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947665/; classtype:trojan-activity;sid:84810765; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947663)"; flow:established,from_client; content:"GET"; http_method; content:"/bin/0d96f1b3812d6a4c_build_x64.exe"; http_uri; depth:35; isdataat:!1,relative; nocase; content:"193.178.158.57"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947663/; classtype:trojan-activity;sid:84810763; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947662)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"219.154.155.199"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947662/; classtype:trojan-activity;sid:84810762; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947661)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"190.103.72.185"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947661/; classtype:trojan-activity;sid:84810761; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947660)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.58.33.104"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947660/; classtype:trojan-activity;sid:84810760; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947659)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.23.77.13"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947659/; classtype:trojan-activity;sid:84810759; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947658)"; flow:established,from_client; content:"GET"; http_method; content:"/i686"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"45.135.194.116"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947658/; classtype:trojan-activity;sid:84810758; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947657)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"190.103.72.185"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947657/; classtype:trojan-activity;sid:84810757; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947656)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"105.186.68.166"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947656/; classtype:trojan-activity;sid:84810756; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947655)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"117.245.138.57"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947655/; classtype:trojan-activity;sid:84810755; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947654)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1558100015321317546/1558470943750488164/bundle.zip|3f|ex=6acb8eab|7c|26|7c|is=6aca3d2b|7c|26|7c|hm=823d4ec1eb00862e82c5e1faf5a96c73640a9be12593792012549921e2548d60|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947654/; classtype:trojan-activity;sid:84810754; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947653)"; flow:established,from_client; content:"GET"; http_method; content:"/akkcoc521-blip/honeyrobloxx/releases/download/downladoa/dsalkasdkadl.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947653/; classtype:trojan-activity;sid:84810753; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947652)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"78.187.104.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947652/; classtype:trojan-activity;sid:84810752; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947651)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1519428468599951424/1558507756103663817/bundle.zip|3f|ex=6acbb0f4|7c|26|7c|is=6aca5f74|7c|26|7c|hm=19eb8260b081867593529f72653fb354cb2c749336e2a685ec2a240e9c797df3|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947651/; classtype:trojan-activity;sid:84810751; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947645)"; flow:established,from_client; content:"GET"; http_method; content:"/downloads/radium_client.jar"; http_uri; depth:28; isdataat:!1,relative; nocase; content:"niggersmp.net"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947645/; classtype:trojan-activity;sid:84810745; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947646)"; flow:established,from_client; content:"GET"; http_method; content:"/xeno.rar"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"xeno-cheats.xyz"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947646/; classtype:trojan-activity;sid:84810746; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947647)"; flow:established,from_client; content:"GET"; http_method; content:"/downloads/krypton.jar"; http_uri; depth:22; isdataat:!1,relative; nocase; content:"niggersmp.net"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947647/; classtype:trojan-activity;sid:84810747; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947648)"; flow:established,from_client; content:"GET"; http_method; content:"/ad5bv9xw9nmggrwwuge6mtism3r4qnfn7ax_nj6db0gxszdmhdjs0ajzf7kr3fvsdiixprfaltd6abee_yqz5z0r0f5gzk-y9vq7w8x1stuyx5twtpadocwsnxqn4s4q2p644gfweivoxnp287fsmfsbnlkq1jbpz5btvgwc5r4/t1rg0bos6coudtl/overx+loaderv.5.6.zip"; http_uri; depth:210; isdataat:!1,relative; nocase; content:"download2260.mediafire.com"; http_host; depth:26; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947648/; classtype:trojan-activity;sid:84810748; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947649)"; flow:established,from_client; content:"GET"; http_method; content:"/downloads/4e_client.jar"; http_uri; depth:24; isdataat:!1,relative; nocase; content:"niggersmp.net"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947649/; classtype:trojan-activity;sid:84810749; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947650)"; flow:established,from_client; content:"GET"; http_method; content:"/downloads/zyphers_rig_mod.jar"; http_uri; depth:30; isdataat:!1,relative; nocase; content:"niggersmp.net"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947650/; classtype:trojan-activity;sid:84810750; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947644)"; flow:established,from_client; content:"GET"; http_method; content:"/tadashi/tadashi.x64"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"176.65.139.231"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947644/; classtype:trojan-activity;sid:84810744; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947643)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.137.250.123"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947643/; classtype:trojan-activity;sid:84810743; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947642)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.177.163.57"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947642/; classtype:trojan-activity;sid:84810742; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947641)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"78.187.104.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947641/; classtype:trojan-activity;sid:84810741; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947640)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.9.196.5"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947640/; classtype:trojan-activity;sid:84810740; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947639)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.138.150.224"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947639/; classtype:trojan-activity;sid:84810739; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947638)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"124.6.167.113"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947638/; classtype:trojan-activity;sid:84810738; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947637)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.44.146.163"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947637/; classtype:trojan-activity;sid:84810737; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947636)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.9.154.249"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947636/; classtype:trojan-activity;sid:84810736; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947635)"; flow:established,from_client; content:"GET"; http_method; content:"/app/apk"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"mobiletoolapp.com"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947635/; classtype:trojan-activity;sid:84810735; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947634)"; flow:established,from_client; content:"GET"; http_method; content:"/app/apk"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"coreprotector.org"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947634/; classtype:trojan-activity;sid:84810734; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947633)"; flow:established,from_client; content:"GET"; http_method; content:"/app/apk"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"38.180.162.39"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947633/; classtype:trojan-activity;sid:84810733; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947632)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.138.150.224"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947632/; classtype:trojan-activity;sid:84810732; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947631)"; flow:established,from_client; content:"GET"; http_method; content:"/files-129312398/files/file_d44be89d905978ed.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"91.92.242.236"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947631/; classtype:trojan-activity;sid:84810731; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947630)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"220.164.23.33"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947630/; classtype:trojan-activity;sid:84810730; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947629)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.127.251.169"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947629/; classtype:trojan-activity;sid:84810729; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947628)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.52.17.181"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947628/; classtype:trojan-activity;sid:84810728; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947626)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.155.62.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947626/; classtype:trojan-activity;sid:84810726; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947627)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.117.151.7"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947627/; classtype:trojan-activity;sid:84810727; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947625)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"210.208.106.68"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947625/; classtype:trojan-activity;sid:84810725; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947624)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"218.28.150.23"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947624/; classtype:trojan-activity;sid:84810724; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947623)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.127.26.104"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947623/; classtype:trojan-activity;sid:84810723; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947622)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.44.146.163"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947622/; classtype:trojan-activity;sid:84810722; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947621)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.227.44.40"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947621/; classtype:trojan-activity;sid:84810721; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947620)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.239.65.72"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947620/; classtype:trojan-activity;sid:84810720; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947619)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.190.242.241"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947619/; classtype:trojan-activity;sid:84810719; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947618)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.148.152.16"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947618/; classtype:trojan-activity;sid:84810718; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947617)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.14.185.42"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947617/; classtype:trojan-activity;sid:84810717; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947615)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"170.254.10.219"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947615/; classtype:trojan-activity;sid:84810715; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947616)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.52.230.84"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947616/; classtype:trojan-activity;sid:84810716; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947614)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.117.251.43"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947614/; classtype:trojan-activity;sid:84810714; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947613)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"119.117.251.43"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947613/; classtype:trojan-activity;sid:84810713; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947610)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.230.38.184"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947610/; classtype:trojan-activity;sid:84810710; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947611)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.224.84.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947611/; classtype:trojan-activity;sid:84810711; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947612)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.224.84.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947612/; classtype:trojan-activity;sid:84810712; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947609)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.224.182.247"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947609/; classtype:trojan-activity;sid:84810709; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947608)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.207.112.61"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947608/; classtype:trojan-activity;sid:84810708; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947606)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.49.129.97"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947606/; classtype:trojan-activity;sid:84810706; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947607)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.49.3.192"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947607/; classtype:trojan-activity;sid:84810707; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947604)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"113.239.65.72"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947604/; classtype:trojan-activity;sid:84810704; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947605)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.205.158.224"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947605/; classtype:trojan-activity;sid:84810705; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947603)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.203.206.182"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947603/; classtype:trojan-activity;sid:84810703; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947602)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.12.46.185"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947602/; classtype:trojan-activity;sid:84810702; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947601)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.104.39.108"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947601/; classtype:trojan-activity;sid:84810701; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947599)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.228.37.155"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947599/; classtype:trojan-activity;sid:84810699; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947600)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.11.0.252"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947600/; classtype:trojan-activity;sid:84810700; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947598)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.224.11.100"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947598/; classtype:trojan-activity;sid:84810698; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947597)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.86.53.125"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947597/; classtype:trojan-activity;sid:84810697; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947596)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.186.118.157"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947596/; classtype:trojan-activity;sid:84810696; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947595)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"45.194.88.27"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947595/; classtype:trojan-activity;sid:84810695; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947594)"; flow:established,from_client; content:"GET"; http_method; content:"/bin/screenconnect.clientsetup.exe"; http_uri; depth:34; isdataat:!1,relative; nocase; content:"144.172.64.22"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947594/; classtype:trojan-activity;sid:84810694; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947593)"; flow:established,from_client; content:"GET"; http_method; content:"/bin/support.client.exe"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"144.172.64.22"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947593/; classtype:trojan-activity;sid:84810693; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947592)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.11.220.74"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947592/; classtype:trojan-activity;sid:84810692; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947591)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.12.46.185"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947591/; classtype:trojan-activity;sid:84810691; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947589)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/telnet.sh"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"176.65.139.135"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947589/; classtype:trojan-activity;sid:84810689; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947590)"; flow:established,from_client; content:"GET"; http_method; content:"/dvr.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"176.65.139.135"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947590/; classtype:trojan-activity;sid:84810690; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947588)"; flow:established,from_client; content:"GET"; http_method; content:"/bin/screenconnect.clientsetup.msi"; http_uri; depth:34; isdataat:!1,relative; nocase; content:"swervimgbackj.top"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947588/; classtype:trojan-activity;sid:84810688; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947587)"; flow:established,from_client; content:"GET"; http_method; content:"/installer.ps1"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"accessdocu.b-cdn.net"; http_host; depth:20; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947587/; classtype:trojan-activity;sid:84810687; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947584)"; flow:established,from_client; content:"GET"; http_method; content:"/x86"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947584/; classtype:trojan-activity;sid:84810684; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947585)"; flow:established,from_client; content:"GET"; http_method; content:"/x64"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947585/; classtype:trojan-activity;sid:84810685; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947586)"; flow:established,from_client; content:"GET"; http_method; content:"/t/mips"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947586/; classtype:trojan-activity;sid:84810686; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947582)"; flow:established,from_client; content:"GET"; http_method; content:"/x86_32"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947582/; classtype:trojan-activity;sid:84810682; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947583)"; flow:established,from_client; content:"GET"; http_method; content:"/t/mpsl"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947583/; classtype:trojan-activity;sid:84810683; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947580)"; flow:established,from_client; content:"GET"; http_method; content:"/files/meteor-client/meteor-client-1.21.11-86.jar"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"modhollow.netlify.app"; http_host; depth:21; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947580/; classtype:trojan-activity;sid:84810680; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947581)"; flow:established,from_client; content:"GET"; http_method; content:"/files/krypton-client/krypton%20client%201.21.11_1.jar"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"modhollow.netlify.app"; http_host; depth:21; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947581/; classtype:trojan-activity;sid:84810681; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947579)"; flow:established,from_client; content:"GET"; http_method; content:"/files/opsec/opsec-1.21.11%2bv1.1.7.1.jar"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"modhollow.netlify.app"; http_host; depth:21; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947579/; classtype:trojan-activity;sid:84810679; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947577)"; flow:established,from_client; content:"GET"; http_method; content:"/p/ihoasub.rar"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"0807.st"; http_host; depth:7; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947577/; classtype:trojan-activity;sid:84810677; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947578)"; flow:established,from_client; content:"GET"; http_method; content:"/p/7uwn25a.rar"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"0807.st"; http_host; depth:7; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947578/; classtype:trojan-activity;sid:84810678; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947575)"; flow:established,from_client; content:"GET"; http_method; content:"/downloads/goobaaclient.1.21.11.jar"; http_uri; depth:35; isdataat:!1,relative; nocase; content:"goobaaclient.com"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947575/; classtype:trojan-activity;sid:84810675; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947573)"; flow:established,from_client; content:"GET"; http_method; content:"/uploads/b%d0%be%d0%bets%d0%b5%d1%85%d0%b5c-64.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"exec-roblox.com"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947573/; classtype:trojan-activity;sid:84810673; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947574)"; flow:established,from_client; content:"GET"; http_method; content:"/champ"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"2.27.14.196"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947574/; classtype:trojan-activity;sid:84810674; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947571)"; flow:established,from_client; content:"GET"; http_method; content:"/deploy.sh"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"176.65.139.231"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947571/; classtype:trojan-activity;sid:84810671; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947572)"; flow:established,from_client; content:"GET"; http_method; content:"/wget.sh"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"176.65.139.231"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947572/; classtype:trojan-activity;sid:84810672; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947565)"; flow:established,from_client; content:"GET"; http_method; content:"/t/arm7"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947565/; classtype:trojan-activity;sid:84810665; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947566)"; flow:established,from_client; content:"GET"; http_method; content:"/svc/u.sh|3f|h=dexec"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"campus-engine-neural-chorus.trycloudflare.com"; http_host; depth:45; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947566/; classtype:trojan-activity;sid:84810666; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947567)"; flow:established,from_client; content:"GET"; http_method; content:"/m68k"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947567/; classtype:trojan-activity;sid:84810667; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947568)"; flow:established,from_client; content:"GET"; http_method; content:"/riscv64"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947568/; classtype:trojan-activity;sid:84810668; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947569)"; flow:established,from_client; content:"GET"; http_method; content:"/riscv"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947569/; classtype:trojan-activity;sid:84810669; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947570)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1558100015321317546/1558450520358654023/bundle_2.zip|3f|ex=6acb7ba6|7c|26|7c|is=6aca2a26|7c|26|7c|hm=e00f5777b997bfc71b50b385a548d80bb293af88436931c918351cf9ac471c15|7c|26|7c|"; http_uri; depth:188; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947570/; classtype:trojan-activity;sid:84810670; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947557)"; flow:established,from_client; content:"GET"; http_method; content:"/downloads/polarloader.jar"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"polar.moe"; http_host; depth:9; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947557/; classtype:trojan-activity;sid:84810657; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947558)"; flow:established,from_client; content:"GET"; http_method; content:"/mips64el"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947558/; classtype:trojan-activity;sid:84810658; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947559)"; flow:established,from_client; content:"GET"; http_method; content:"/i586"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947559/; classtype:trojan-activity;sid:84810659; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947560)"; flow:established,from_client; content:"GET"; http_method; content:"/arm64"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947560/; classtype:trojan-activity;sid:84810660; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947561)"; flow:established,from_client; content:"GET"; http_method; content:"/amd64"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947561/; classtype:trojan-activity;sid:84810661; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947562)"; flow:established,from_client; content:"GET"; http_method; content:"/ppc64"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947562/; classtype:trojan-activity;sid:84810662; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947563)"; flow:established,from_client; content:"GET"; http_method; content:"/mips64le"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947563/; classtype:trojan-activity;sid:84810663; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947564)"; flow:established,from_client; content:"GET"; http_method; content:"/mpsl"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947564/; classtype:trojan-activity;sid:84810664; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947556)"; flow:established,from_client; content:"GET"; http_method; content:"/storage/v1/object/sign/krypton%20client%201.21x/krypton%20client%201.21x.jar|3f|token=eyjrawqioiizodi0ztg5ns04mjy5ltrmzgetywnlzc02m2nhyjy5ywm1mdailcjhbgcioijiuzuxmij9.eyj1cmwioijlcnlwdg9uiensawvudcaxljixec9lcnlwdg9uiensawvudcaxljixec5qyxiilcjzy29wzsi6imrvd25sb2fkiiwiawf0ijoxnzkxntkyotkylcjlehaioje4mjmxmjg5otj9.7wtbewdrq0klbq_umhaharloky5cmotwpqesgg8j110mpcgm_9pxzeseobudxv99h1ydjeq7cp-na1ql4vmbtq"; http_uri; depth:399; isdataat:!1,relative; nocase; content:"hylrukrxwfwbooknmtyx.supabase.co"; http_host; depth:32; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947556/; classtype:trojan-activity;sid:84810656; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947552)"; flow:established,from_client; content:"GET"; http_method; content:"/p/y2mqku9.dat"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"0807.st"; http_host; depth:7; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947552/; classtype:trojan-activity;sid:84810652; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947553)"; flow:established,from_client; content:"GET"; http_method; content:"/t/mipsel"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947553/; classtype:trojan-activity;sid:84810653; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947554)"; flow:established,from_client; content:"GET"; http_method; content:"/armv7"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947554/; classtype:trojan-activity;sid:84810654; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947555)"; flow:established,from_client; content:"GET"; http_method; content:"/i386"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947555/; classtype:trojan-activity;sid:84810655; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947548)"; flow:established,from_client; content:"GET"; http_method; content:"/powerpc64"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947548/; classtype:trojan-activity;sid:84810648; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947549)"; flow:established,from_client; content:"GET"; http_method; content:"/mipsle"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947549/; classtype:trojan-activity;sid:84810649; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947550)"; flow:established,from_client; content:"GET"; http_method; content:"/arm7n"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947550/; classtype:trojan-activity;sid:84810650; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947551)"; flow:established,from_client; content:"GET"; http_method; content:"/s"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947551/; classtype:trojan-activity;sid:84810651; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947546)"; flow:established,from_client; content:"GET"; http_method; content:"/svc/"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"pole-mother-visiting-trinity.trycloudflare.com"; http_host; depth:46; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947546/; classtype:trojan-activity;sid:84810646; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947547)"; flow:established,from_client; content:"GET"; http_method; content:"/armhf"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947547/; classtype:trojan-activity;sid:84810647; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947545)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.53.69.164"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947545/; classtype:trojan-activity;sid:84810645; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947542)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.28.153.108"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947542/; classtype:trojan-activity;sid:84810642; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947543)"; flow:established,from_client; content:"GET"; http_method; content:"/sh"; http_uri; depth:3; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947543/; classtype:trojan-activity;sid:84810643; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947544)"; flow:established,from_client; content:"GET"; http_method; content:"/sh4"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947544/; classtype:trojan-activity;sid:84810644; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947541)"; flow:established,from_client; content:"GET"; http_method; content:"/svc/r|3f|h=vv"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"campus-engine-neural-chorus.trycloudflare.com"; http_host; depth:45; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947541/; classtype:trojan-activity;sid:84810641; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947536)"; flow:established,from_client; content:"GET"; http_method; content:"/main_x86_64"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"94.154.43.26"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947536/; classtype:trojan-activity;sid:84810636; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947537)"; flow:established,from_client; content:"GET"; http_method; content:"/main_sh4"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"94.154.43.26"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947537/; classtype:trojan-activity;sid:84810637; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947538)"; flow:established,from_client; content:"GET"; http_method; content:"/main_m68k"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"94.154.43.26"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947538/; classtype:trojan-activity;sid:84810638; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947539)"; flow:established,from_client; content:"GET"; http_method; content:"/main_mips"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"94.154.43.26"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947539/; classtype:trojan-activity;sid:84810639; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947540)"; flow:established,from_client; content:"GET"; http_method; content:"/main_ppc"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"94.154.43.26"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947540/; classtype:trojan-activity;sid:84810640; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947530)"; flow:established,from_client; content:"GET"; http_method; content:"/main_arm7"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"94.154.43.26"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947530/; classtype:trojan-activity;sid:84810630; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947531)"; flow:established,from_client; content:"GET"; http_method; content:"/main_mpsl"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"94.154.43.26"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947531/; classtype:trojan-activity;sid:84810631; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947532)"; flow:established,from_client; content:"GET"; http_method; content:"/main_x86"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"94.154.43.26"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947532/; classtype:trojan-activity;sid:84810632; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947533)"; flow:established,from_client; content:"GET"; http_method; content:"/main_arm5"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"94.154.43.26"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947533/; classtype:trojan-activity;sid:84810633; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947534)"; flow:established,from_client; content:"GET"; http_method; content:"/main_arm6"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"94.154.43.26"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947534/; classtype:trojan-activity;sid:84810634; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947535)"; flow:established,from_client; content:"GET"; http_method; content:"/main_arm"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"94.154.43.26"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947535/; classtype:trojan-activity;sid:84810635; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947526)"; flow:established,from_client; content:"GET"; http_method; content:"/lel.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"176.65.139.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947526/; classtype:trojan-activity;sid:84810626; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947527)"; flow:established,from_client; content:"GET"; http_method; content:"/mpsl"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"176.65.139.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947527/; classtype:trojan-activity;sid:84810627; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947528)"; flow:established,from_client; content:"GET"; http_method; content:"/armv5"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"176.65.139.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947528/; classtype:trojan-activity;sid:84810628; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947529)"; flow:established,from_client; content:"GET"; http_method; content:"/lol.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"176.65.139.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947529/; classtype:trojan-activity;sid:84810629; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947522)"; flow:established,from_client; content:"GET"; http_method; content:"/armv7"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"176.65.139.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947522/; classtype:trojan-activity;sid:84810622; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947523)"; flow:established,from_client; content:"GET"; http_method; content:"/x64s"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"176.65.139.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947523/; classtype:trojan-activity;sid:84810623; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947524)"; flow:established,from_client; content:"GET"; http_method; content:"/mips"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"176.65.139.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947524/; classtype:trojan-activity;sid:84810624; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947525)"; flow:established,from_client; content:"GET"; http_method; content:"/aarch64"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"176.65.139.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947525/; classtype:trojan-activity;sid:84810625; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947521)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.238.143.132"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947521/; classtype:trojan-activity;sid:84810621; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947520)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"118.251.12.82"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947520/; classtype:trojan-activity;sid:84810620; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947518)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.84.212.113"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947518/; classtype:trojan-activity;sid:84810618; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947519)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.11.0.252"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947519/; classtype:trojan-activity;sid:84810619; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947516)"; flow:established,from_client; content:"GET"; http_method; content:"/riscv32"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947516/; classtype:trojan-activity;sid:84810616; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947517)"; flow:established,from_client; content:"GET"; http_method; content:"/s390x"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947517/; classtype:trojan-activity;sid:84810617; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947514)"; flow:established,from_client; content:"GET"; http_method; content:"/x86"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947514/; classtype:trojan-activity;sid:84810614; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947515)"; flow:established,from_client; content:"GET"; http_method; content:"/x86_64"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947515/; classtype:trojan-activity;sid:84810615; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947504)"; flow:established,from_client; content:"GET"; http_method; content:"/pid.ppc64"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947504/; classtype:trojan-activity;sid:84810604; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947505)"; flow:established,from_client; content:"GET"; http_method; content:"/launch.sh"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947505/; classtype:trojan-activity;sid:84810605; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947506)"; flow:established,from_client; content:"GET"; http_method; content:"/ppc64"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947506/; classtype:trojan-activity;sid:84810606; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947507)"; flow:established,from_client; content:"GET"; http_method; content:"/android-arm64"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947507/; classtype:trojan-activity;sid:84810607; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947508)"; flow:established,from_client; content:"GET"; http_method; content:"/android-arm"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947508/; classtype:trojan-activity;sid:84810608; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947509)"; flow:established,from_client; content:"GET"; http_method; content:"/pid.x86"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947509/; classtype:trojan-activity;sid:84810609; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947510)"; flow:established,from_client; content:"GET"; http_method; content:"/riscv64"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947510/; classtype:trojan-activity;sid:84810610; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947511)"; flow:established,from_client; content:"GET"; http_method; content:"/mips64"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947511/; classtype:trojan-activity;sid:84810611; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947512)"; flow:established,from_client; content:"GET"; http_method; content:"/bot.x86_64"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947512/; classtype:trojan-activity;sid:84810612; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947513)"; flow:established,from_client; content:"GET"; http_method; content:"/pid.x86_64"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947513/; classtype:trojan-activity;sid:84810613; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947494)"; flow:established,from_client; content:"GET"; http_method; content:"/pid.ppc"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947494/; classtype:trojan-activity;sid:84810594; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947495)"; flow:established,from_client; content:"GET"; http_method; content:"/pid.mips"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947495/; classtype:trojan-activity;sid:84810595; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947496)"; flow:established,from_client; content:"GET"; http_method; content:"/arm8"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947496/; classtype:trojan-activity;sid:84810596; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947497)"; flow:established,from_client; content:"GET"; http_method; content:"/pid.arm7"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947497/; classtype:trojan-activity;sid:84810597; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947498)"; flow:established,from_client; content:"GET"; http_method; content:"/pid.m68k"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947498/; classtype:trojan-activity;sid:84810598; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947499)"; flow:established,from_client; content:"GET"; http_method; content:"/pid.arm5"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947499/; classtype:trojan-activity;sid:84810599; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947500)"; flow:established,from_client; content:"GET"; http_method; content:"/pid.arm6"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947500/; classtype:trojan-activity;sid:84810600; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947501)"; flow:established,from_client; content:"GET"; http_method; content:"/bot.arm"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947501/; classtype:trojan-activity;sid:84810601; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947502)"; flow:established,from_client; content:"GET"; http_method; content:"/pid.arm"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947502/; classtype:trojan-activity;sid:84810602; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947503)"; flow:established,from_client; content:"GET"; http_method; content:"/pid.mipsel"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947503/; classtype:trojan-activity;sid:84810603; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947493)"; flow:established,from_client; content:"GET"; http_method; content:"/j.sh"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947493/; classtype:trojan-activity;sid:84810593; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947491)"; flow:established,from_client; content:"GET"; http_method; content:"/pid.arm8"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947491/; classtype:trojan-activity;sid:84810591; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947492)"; flow:established,from_client; content:"GET"; http_method; content:"/mipsel"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947492/; classtype:trojan-activity;sid:84810592; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947490)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"118.251.12.82"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947490/; classtype:trojan-activity;sid:84810590; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947489)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.230.38.184"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947489/; classtype:trojan-activity;sid:84810589; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947488)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.48.152.62"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947488/; classtype:trojan-activity;sid:84810588; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947487)"; flow:established,from_client; content:"GET"; http_method; content:"/debug"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"176.65.139.136"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947487/; classtype:trojan-activity;sid:84810587; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947474)"; flow:established,from_client; content:"GET"; http_method; content:"/iran.armv4l"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"176.65.139.166"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947474/; classtype:trojan-activity;sid:84810574; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947475)"; flow:established,from_client; content:"GET"; http_method; content:"/iran.m68k"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"176.65.139.166"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947475/; classtype:trojan-activity;sid:84810575; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947476)"; flow:established,from_client; content:"GET"; http_method; content:"/iran.powerpc"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"176.65.139.166"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947476/; classtype:trojan-activity;sid:84810576; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947477)"; flow:established,from_client; content:"GET"; http_method; content:"/iran.mips"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"176.65.139.166"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947477/; classtype:trojan-activity;sid:84810577; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947478)"; flow:established,from_client; content:"GET"; http_method; content:"/iran.sparc"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"176.65.139.166"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947478/; classtype:trojan-activity;sid:84810578; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947479)"; flow:established,from_client; content:"GET"; http_method; content:"/iran.armv7l"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"176.65.139.166"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947479/; classtype:trojan-activity;sid:84810579; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947480)"; flow:established,from_client; content:"GET"; http_method; content:"/iran.arc"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"176.65.139.166"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947480/; classtype:trojan-activity;sid:84810580; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947481)"; flow:established,from_client; content:"GET"; http_method; content:"/iran.mipsrouter"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"176.65.139.166"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947481/; classtype:trojan-activity;sid:84810581; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947482)"; flow:established,from_client; content:"GET"; http_method; content:"/iran.mipsel"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"176.65.139.166"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947482/; classtype:trojan-activity;sid:84810582; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947483)"; flow:established,from_client; content:"GET"; http_method; content:"/iran.armv6l"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"176.65.139.166"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947483/; classtype:trojan-activity;sid:84810583; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947484)"; flow:established,from_client; content:"GET"; http_method; content:"/iran.i486"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"176.65.139.166"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947484/; classtype:trojan-activity;sid:84810584; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947485)"; flow:established,from_client; content:"GET"; http_method; content:"/iran.sh4"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"176.65.139.166"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947485/; classtype:trojan-activity;sid:84810585; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947486)"; flow:established,from_client; content:"GET"; http_method; content:"/iran.armv5l"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"176.65.139.166"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947486/; classtype:trojan-activity;sid:84810586; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947473)"; flow:established,from_client; content:"GET"; http_method; content:"/iran.aarch64"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"176.65.139.166"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947473/; classtype:trojan-activity;sid:84810573; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947472)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.10.238.251"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947472/; classtype:trojan-activity;sid:84810572; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947471)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"121.205.208.78"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947471/; classtype:trojan-activity;sid:84810571; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947470)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"112.198.195.40"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947470/; classtype:trojan-activity;sid:84810570; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947469)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.48.152.62"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947469/; classtype:trojan-activity;sid:84810569; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947468)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.186.68.166"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947468/; classtype:trojan-activity;sid:84810568; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947467)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"5.167.126.229"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947467/; classtype:trojan-activity;sid:84810567; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947466)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"58.21.122.54"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947466/; classtype:trojan-activity;sid:84810566; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947465)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"151.233.145.221"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947465/; classtype:trojan-activity;sid:84810565; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947464)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.141.97.98"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947464/; classtype:trojan-activity;sid:84810564; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947463)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.207.84.249"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947463/; classtype:trojan-activity;sid:84810563; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947462)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.49.203.91"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947462/; classtype:trojan-activity;sid:84810562; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947461)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.23.239.46"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947461/; classtype:trojan-activity;sid:84810561; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947460)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.141.97.98"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947460/; classtype:trojan-activity;sid:84810560; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947459)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"77.79.160.210"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947459/; classtype:trojan-activity;sid:84810559; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947458)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.23.239.46"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947458/; classtype:trojan-activity;sid:84810558; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947457)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.97.250.127"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947457/; classtype:trojan-activity;sid:84810557; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947456)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"116.10.133.42"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947456/; classtype:trojan-activity;sid:84810556; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947455)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"120.28.189.218"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947455/; classtype:trojan-activity;sid:84810555; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947454)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.42.81.163"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947454/; classtype:trojan-activity;sid:84810554; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947453)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"61.52.4.108"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947453/; classtype:trojan-activity;sid:84810553; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947452)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.114.33.57"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947452/; classtype:trojan-activity;sid:84810552; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947449)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.126.240.218"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947449/; classtype:trojan-activity;sid:84810549; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947450)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"63.245.153.71"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947450/; classtype:trojan-activity;sid:84810550; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947451)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"180.245.62.121"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947451/; classtype:trojan-activity;sid:84810551; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947448)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.121.156.64"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947448/; classtype:trojan-activity;sid:84810548; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947447)"; flow:established,from_client; content:"GET"; http_method; content:"/linux"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"47.105.74.195"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947447/; classtype:trojan-activity;sid:84810547; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947446)"; flow:established,from_client; content:"GET"; http_method; content:"/linux"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"47.102.102.45"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947446/; classtype:trojan-activity;sid:84810546; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947444)"; flow:established,from_client; content:"GET"; http_method; content:"/tot"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"176.65.139.40"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947444/; classtype:trojan-activity;sid:84810544; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947445)"; flow:established,from_client; content:"GET"; http_method; content:"/ezo"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"66.116.196.142"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947445/; classtype:trojan-activity;sid:84810545; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947443)"; flow:established,from_client; content:"GET"; http_method; content:"/cot"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"217.60.196.2"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947443/; classtype:trojan-activity;sid:84810543; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947442)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.236.213.139"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947442/; classtype:trojan-activity;sid:84810542; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947438)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"96.246.230.97"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947438/; classtype:trojan-activity;sid:84810538; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947439)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"98.36.141.73"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947439/; classtype:trojan-activity;sid:84810539; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947440)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.150.255.147"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947440/; classtype:trojan-activity;sid:84810540; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947441)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"110.136.60.67"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947441/; classtype:trojan-activity;sid:84810541; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947437)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.14.152.127"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947437/; classtype:trojan-activity;sid:84810537; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947436)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.44.49.37"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947436/; classtype:trojan-activity;sid:84810536; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947427)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.42.81.163"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947427/; classtype:trojan-activity;sid:84810527; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947428)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.149.80.109"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947428/; classtype:trojan-activity;sid:84810528; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947429)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.236.213.139"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947429/; classtype:trojan-activity;sid:84810529; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947430)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.9.193.142"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947430/; classtype:trojan-activity;sid:84810530; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947431)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.230.218.97"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947431/; classtype:trojan-activity;sid:84810531; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947432)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.5.126.90"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947432/; classtype:trojan-activity;sid:84810532; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947433)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.45.137.35"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947433/; classtype:trojan-activity;sid:84810533; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947434)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.227.243.218"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947434/; classtype:trojan-activity;sid:84810534; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947435)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.156.81.230"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947435/; classtype:trojan-activity;sid:84810535; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947426)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"160.176.248.175"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947426/; classtype:trojan-activity;sid:84810526; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947425)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.14.152.127"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947425/; classtype:trojan-activity;sid:84810525; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947424)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.61.115.27"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947424/; classtype:trojan-activity;sid:84810524; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947423)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.225.69.120"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947423/; classtype:trojan-activity;sid:84810523; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947422)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"105.184.8.241"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947422/; classtype:trojan-activity;sid:84810522; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947421)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.59.228.174"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947421/; classtype:trojan-activity;sid:84810521; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947419)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.130.230.248"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947419/; classtype:trojan-activity;sid:84810519; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947420)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.239.81.126"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947420/; classtype:trojan-activity;sid:84810520; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947418)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.127.111.22"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947418/; classtype:trojan-activity;sid:84810518; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947417)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"61.53.140.159"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947417/; classtype:trojan-activity;sid:84810517; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947416)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.59.228.174"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947416/; classtype:trojan-activity;sid:84810516; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947413)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"116.140.7.177"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947413/; classtype:trojan-activity;sid:84810513; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947414)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"103.172.186.170"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947414/; classtype:trojan-activity;sid:84810514; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947415)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.53.69.165"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947415/; classtype:trojan-activity;sid:84810515; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947412)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"193.93.228.160"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947412/; classtype:trojan-activity;sid:84810512; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947411)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"218.90.26.232"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947411/; classtype:trojan-activity;sid:84810511; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947410)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.225.86.235"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947410/; classtype:trojan-activity;sid:84810510; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947409)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"109.194.28.77"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947409/; classtype:trojan-activity;sid:84810509; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947408)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.37.225.158"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947408/; classtype:trojan-activity;sid:84810508; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947407)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.28.195.161"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947407/; classtype:trojan-activity;sid:84810507; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947405)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"116.140.7.177"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947405/; classtype:trojan-activity;sid:84810505; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947406)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"116.138.107.83"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947406/; classtype:trojan-activity;sid:84810506; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947404)"; flow:established,from_client; content:"GET"; http_method; content:"/dl/thwin_ev.exe"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"situations-clarity-pill-preceding.trycloudflare.com"; http_host; depth:51; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947404/; classtype:trojan-activity;sid:84810504; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947403)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.m"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"36.49.52.140"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947403/; classtype:trojan-activity;sid:84810503; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947402)"; flow:established,from_client; content:"GET"; http_method; content:"/st_x86_64"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"217.60.195.187"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947402/; classtype:trojan-activity;sid:84810502; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947401)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1558364083370074233/1558364277403033711/bundle_4.zip|3f|ex=6acb2b54|7c|26|7c|is=6ac9d9d4|7c|26|7c|hm=ffd2c51dd209735f2a2ccc8de812c0c0f8854b2babe383cab988e03265f1272f|7c|26|7c|"; http_uri; depth:188; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947401/; classtype:trojan-activity;sid:84810501; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947400)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.13.151.100"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947400/; classtype:trojan-activity;sid:84810500; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947399)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.137.77.98"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947399/; classtype:trojan-activity;sid:84810499; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947398)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"116.139.186.161"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947398/; classtype:trojan-activity;sid:84810498; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947397)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.114.134.132"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947397/; classtype:trojan-activity;sid:84810497; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947396)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"112.248.113.211"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947396/; classtype:trojan-activity;sid:84810496; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947395)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.224.249.51"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947395/; classtype:trojan-activity;sid:84810495; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947394)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.57.13.93"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947394/; classtype:trojan-activity;sid:84810494; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947393)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.50.70.95"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947393/; classtype:trojan-activity;sid:84810493; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947392)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.28.135.4"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947392/; classtype:trojan-activity;sid:84810492; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947391)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.19.240.170"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947391/; classtype:trojan-activity;sid:84810491; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947384)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/android/akuma_arc"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947384/; classtype:trojan-activity;sid:84810484; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947385)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/android/akuma_arm"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947385/; classtype:trojan-activity;sid:84810485; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947386)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/android/akuma_i586"; http_uri; depth:24; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947386/; classtype:trojan-activity;sid:84810486; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947387)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/android/akuma_arm6"; http_uri; depth:24; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947387/; classtype:trojan-activity;sid:84810487; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947388)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/android/akuma_i486"; http_uri; depth:24; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947388/; classtype:trojan-activity;sid:84810488; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947389)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/android/akuma_mpsl"; http_uri; depth:24; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947389/; classtype:trojan-activity;sid:84810489; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947390)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/android/akuma_arm64"; http_uri; depth:25; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947390/; classtype:trojan-activity;sid:84810490; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947377)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/android/akuma_arm7"; http_uri; depth:24; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947377/; classtype:trojan-activity;sid:84810477; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947378)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/android/akuma_x64"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947378/; classtype:trojan-activity;sid:84810478; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947379)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/android/akuma_ppc"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947379/; classtype:trojan-activity;sid:84810479; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947380)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/android/akuma_sh4"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947380/; classtype:trojan-activity;sid:84810480; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947381)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/android/akuma_riscv32"; http_uri; depth:27; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947381/; classtype:trojan-activity;sid:84810481; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947382)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/android/akuma_m68k"; http_uri; depth:24; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947382/; classtype:trojan-activity;sid:84810482; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947383)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/android/akuma_i686"; http_uri; depth:24; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947383/; classtype:trojan-activity;sid:84810483; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947372)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/android/akuma_riscv64"; http_uri; depth:27; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947372/; classtype:trojan-activity;sid:84810472; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947373)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/android/akuma_spc"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947373/; classtype:trojan-activity;sid:84810473; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947374)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/android/akuma_mps64"; http_uri; depth:25; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947374/; classtype:trojan-activity;sid:84810474; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947375)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/android/akuma_arm5"; http_uri; depth:24; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947375/; classtype:trojan-activity;sid:84810475; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947376)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/android/akuma_mips"; http_uri; depth:24; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947376/; classtype:trojan-activity;sid:84810476; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947371)"; flow:established,from_client; content:"GET"; http_method; content:"/|3f|download=1"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"videosnw-ru.vercel.app"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947371/; classtype:trojan-activity;sid:84810471; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947369)"; flow:established,from_client; content:"GET"; http_method; content:"/|3f|download=1"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"dttjjkkllzbvesjzndtp.vercel.app"; http_host; depth:31; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947369/; classtype:trojan-activity;sid:84810469; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947370)"; flow:established,from_client; content:"GET"; http_method; content:"/|3f|download=1"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"gibddru.vercel.app"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947370/; classtype:trojan-activity;sid:84810470; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947368)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.239.168.4"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947368/; classtype:trojan-activity;sid:84810468; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947367)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.240.194.49"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947367/; classtype:trojan-activity;sid:84810467; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947366)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.221.76.194"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947366/; classtype:trojan-activity;sid:84810466; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947365)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.214.23.166"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947365/; classtype:trojan-activity;sid:84810465; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947364)"; flow:established,from_client; content:"GET"; http_method; content:"/install.ps1"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"035bc-ff4b-4cab-bca6-2b633b15def0.gorsefield.cc"; http_host; depth:47; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947364/; classtype:trojan-activity;sid:84810464; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947363)"; flow:established,from_client; content:"GET"; http_method; content:"/0uparm"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947363/; classtype:trojan-activity;sid:84810463; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947362)"; flow:established,from_client; content:"GET"; http_method; content:"/0uparm5"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947362/; classtype:trojan-activity;sid:84810462; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947358)"; flow:established,from_client; content:"GET"; http_method; content:"/pack/agent/nodewatchd-linux-mipsle"; http_uri; depth:35; isdataat:!1,relative; nocase; content:"astroliper.ac"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947358/; classtype:trojan-activity;sid:84810458; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947359)"; flow:established,from_client; content:"GET"; http_method; content:"/pack/agent/nodewatchd-linux-riscv64"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"astroliper.ac"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947359/; classtype:trojan-activity;sid:84810459; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947360)"; flow:established,from_client; content:"GET"; http_method; content:"/pack/agent/nodewatchd-linux-mips"; http_uri; depth:33; isdataat:!1,relative; nocase; content:"astroliper.ac"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947360/; classtype:trojan-activity;sid:84810460; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947361)"; flow:established,from_client; content:"GET"; http_method; content:"/pack/agent/nodewatchd-linux-loong64"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"astroliper.ac"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947361/; classtype:trojan-activity;sid:84810461; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947355)"; flow:established,from_client; content:"GET"; http_method; content:"/rainii686"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"191.44.114.74"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947355/; classtype:trojan-activity;sid:84810455; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947356)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"61.52.92.74"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947356/; classtype:trojan-activity;sid:84810456; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947357)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"201.159.91.2"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947357/; classtype:trojan-activity;sid:84810457; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947354)"; flow:established,from_client; content:"GET"; http_method; content:"/api.php"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"brows-check.codes"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947354/; classtype:trojan-activity;sid:84810454; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947352)"; flow:established,from_client; content:"GET"; http_method; content:"/pack/agent/nodewatchd-linux-mips64le"; http_uri; depth:37; isdataat:!1,relative; nocase; content:"astroliper.ac"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947352/; classtype:trojan-activity;sid:84810452; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947353)"; flow:established,from_client; content:"GET"; http_method; content:"/pack/agent/nodewatchd-linux-mips64"; http_uri; depth:35; isdataat:!1,relative; nocase; content:"astroliper.ac"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947353/; classtype:trojan-activity;sid:84810453; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947351)"; flow:established,from_client; content:"GET"; http_method; content:"/pack/agent/nodewatchd-linux-ppc64le"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"astroliper.ac"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947351/; classtype:trojan-activity;sid:84810451; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947350)"; flow:established,from_client; content:"GET"; http_method; content:"/osmb.jar"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"osmb.net"; http_host; depth:8; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947350/; classtype:trojan-activity;sid:84810450; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947349)"; flow:established,from_client; content:"GET"; http_method; content:"/dl.sh"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947349/; classtype:trojan-activity;sid:84810449; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947348)"; flow:established,from_client; content:"GET"; http_method; content:"/scl/fi/vchxh1gexd1y52wjpyqtk/racingsimulator.zip|3f|rlkey=8bveooct7irzfn71nlpcthfxk|7c|26|7c|st=xnvu11qh|7c|26|7c|dl=1"; http_uri; depth:119; isdataat:!1,relative; nocase; content:"www.dropbox.com"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947348/; classtype:trojan-activity;sid:84810448; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947347)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1554373007819014229/1558219073161138186/bundle1.zip|3f|ex=6acaa419|7c|26|7c|is=6ac95299|7c|26|7c|hm=fa6648fcec9a979c9d2264ff4bc3876e20722df68a2bcc323ae3486cbeff6f06|7c|26|7c|"; http_uri; depth:187; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947347/; classtype:trojan-activity;sid:84810447; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947345)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1557133169877192734/1558228090285465730/bundle.zip|3f|ex=6acaac7f|7c|26|7c|is=6ac95aff|7c|26|7c|hm=bb44fe8c4acac88ab665d8bc71152b3f45f31e3400264e1c65564af8e85f7d50|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947345/; classtype:trojan-activity;sid:84810445; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947346)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1558076945571512441/1558250513563127869/bundle.zip|3f|ex=6acac161|7c|26|7c|is=6ac96fe1|7c|26|7c|hm=79b498e5eacc3b365af817340bee9189c40cc8f81e9918bef84d8302872abc83|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947346/; classtype:trojan-activity;sid:84810446; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947344)"; flow:established,from_client; content:"GET"; http_method; content:"/0upm68k"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947344/; classtype:trojan-activity;sid:84810444; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947343)"; flow:established,from_client; content:"GET"; http_method; content:"/0upmpsl"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947343/; classtype:trojan-activity;sid:84810443; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947342)"; flow:established,from_client; content:"GET"; http_method; content:"/0upx64"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947342/; classtype:trojan-activity;sid:84810442; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947341)"; flow:established,from_client; content:"GET"; http_method; content:"/0upmips"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947341/; classtype:trojan-activity;sid:84810441; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947340)"; flow:established,from_client; content:"GET"; http_method; content:"/0uparm7"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947340/; classtype:trojan-activity;sid:84810440; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947339)"; flow:established,from_client; content:"GET"; http_method; content:"/0uparm6"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947339/; classtype:trojan-activity;sid:84810439; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947338)"; flow:established,from_client; content:"GET"; http_method; content:"/0upsh4"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947338/; classtype:trojan-activity;sid:84810438; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947337)"; flow:established,from_client; content:"GET"; http_method; content:"/0upppc"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947337/; classtype:trojan-activity;sid:84810437; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947336)"; flow:established,from_client; content:"GET"; http_method; content:"/miner_setup.sh"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"100.121.51.8"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947336/; classtype:trojan-activity;sid:84810436; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947334)"; flow:established,from_client; content:"GET"; http_method; content:"/0upx86"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947334/; classtype:trojan-activity;sid:84810434; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947335)"; flow:established,from_client; content:"GET"; http_method; content:"/0upspc"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"45.198.224.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947335/; classtype:trojan-activity;sid:84810435; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947333)"; flow:established,from_client; content:"GET"; http_method; content:"/svc/u.sh|3f|h=dexec"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"pole-mother-visiting-trinity.trycloudflare.com"; http_host; depth:46; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947333/; classtype:trojan-activity;sid:84810433; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947332)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.sparc"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"176.65.139.217"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947332/; classtype:trojan-activity;sid:84810432; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947331)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.x86_64"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"176.65.139.217"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947331/; classtype:trojan-activity;sid:84810431; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947330)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.arc"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"176.65.139.217"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947330/; classtype:trojan-activity;sid:84810430; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947327)"; flow:established,from_client; content:"GET"; http_method; content:"/svc/u.sh|3f|h=docker"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"campus-engine-neural-chorus.trycloudflare.com"; http_host; depth:45; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947327/; classtype:trojan-activity;sid:84810427; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947328)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/payloads/w.sh"; http_uri; depth:19; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947328/; classtype:trojan-activity;sid:84810428; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947329)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/payloads/c.sh"; http_uri; depth:19; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947329/; classtype:trojan-activity;sid:84810429; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947325)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.mips64"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"176.65.139.217"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947325/; classtype:trojan-activity;sid:84810425; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947326)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.i586"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"176.65.139.217"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947326/; classtype:trojan-activity;sid:84810426; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947324)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.193.50.197"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947324/; classtype:trojan-activity;sid:84810424; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947323)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"112.198.193.5"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947323/; classtype:trojan-activity;sid:84810423; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947322)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"220.202.91.248"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947322/; classtype:trojan-activity;sid:84810422; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947321)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"116.10.133.42"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947321/; classtype:trojan-activity;sid:84810421; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947320)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"79.40.75.47"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947320/; classtype:trojan-activity;sid:84810420; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947319)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"220.202.91.248"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947319/; classtype:trojan-activity;sid:84810419; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947318)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.57.42.2"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947318/; classtype:trojan-activity;sid:84810418; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947317)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.155.237.46"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947317/; classtype:trojan-activity;sid:84810417; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947316)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.199.56.198"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947316/; classtype:trojan-activity;sid:84810416; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947315)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"117.91.113.150"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947315/; classtype:trojan-activity;sid:84810415; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947314)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.14.14.72"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947314/; classtype:trojan-activity;sid:84810414; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947312)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.239.190.35"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947312/; classtype:trojan-activity;sid:84810412; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947313)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.239.190.35"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947313/; classtype:trojan-activity;sid:84810413; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947311)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.137.158.220"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947311/; classtype:trojan-activity;sid:84810411; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947310)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.57.42.2"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947310/; classtype:trojan-activity;sid:84810410; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947309)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.61.1.172"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947309/; classtype:trojan-activity;sid:84810409; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947308)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.199.56.198"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947308/; classtype:trojan-activity;sid:84810408; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947305)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"103.192.204.30"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947305/; classtype:trojan-activity;sid:84810405; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947306)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.127.70.192"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947306/; classtype:trojan-activity;sid:84810406; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947307)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.62.177.126"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947307/; classtype:trojan-activity;sid:84810407; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947303)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"119.118.39.79"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947303/; classtype:trojan-activity;sid:84810403; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947304)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.118.39.79"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947304/; classtype:trojan-activity;sid:84810404; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947302)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"112.239.20.46"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947302/; classtype:trojan-activity;sid:84810402; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947301)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.228.41.178"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947301/; classtype:trojan-activity;sid:84810401; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947300)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.52.192.164"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947300/; classtype:trojan-activity;sid:84810400; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947299)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.150.255.147"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947299/; classtype:trojan-activity;sid:84810399; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947298)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.246.159.52"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947298/; classtype:trojan-activity;sid:84810398; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947297)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"103.192.204.30"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947297/; classtype:trojan-activity;sid:84810397; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947295)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.63.14.230"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947295/; classtype:trojan-activity;sid:84810395; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947296)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.62.177.67"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947296/; classtype:trojan-activity;sid:84810396; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947293)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.189.68.239"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947293/; classtype:trojan-activity;sid:84810393; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947294)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.189.98.77"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947294/; classtype:trojan-activity;sid:84810394; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947291)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.227.44.40"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947291/; classtype:trojan-activity;sid:84810391; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947292)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"116.209.183.7"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947292/; classtype:trojan-activity;sid:84810392; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947289)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.137.190.185"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947289/; classtype:trojan-activity;sid:84810389; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947290)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"39.90.146.150"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947290/; classtype:trojan-activity;sid:84810390; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947288)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.52.192.164"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947288/; classtype:trojan-activity;sid:84810388; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947287)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"112.239.20.46"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947287/; classtype:trojan-activity;sid:84810387; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947286)"; flow:established,from_client; content:"GET"; http_method; content:"/arm6"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947286/; classtype:trojan-activity;sid:84810386; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947280)"; flow:established,from_client; content:"GET"; http_method; content:"/arm"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947280/; classtype:trojan-activity;sid:84810380; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947281)"; flow:established,from_client; content:"GET"; http_method; content:"/ppc"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947281/; classtype:trojan-activity;sid:84810381; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947282)"; flow:established,from_client; content:"GET"; http_method; content:"/mips"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947282/; classtype:trojan-activity;sid:84810382; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947283)"; flow:established,from_client; content:"GET"; http_method; content:"/arm5"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947283/; classtype:trojan-activity;sid:84810383; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947284)"; flow:established,from_client; content:"GET"; http_method; content:"/m68k"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947284/; classtype:trojan-activity;sid:84810384; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947285)"; flow:established,from_client; content:"GET"; http_method; content:"/arm7"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"176.65.139.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947285/; classtype:trojan-activity;sid:84810385; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947279)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"221.203.206.182"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947279/; classtype:trojan-activity;sid:84810379; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947278)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"59.180.132.206"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947278/; classtype:trojan-activity;sid:84810378; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947277)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"117.85.190.91"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947277/; classtype:trojan-activity;sid:84810377; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947276)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.139.77.4"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947276/; classtype:trojan-activity;sid:84810376; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947275)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"101.108.150.73"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947275/; classtype:trojan-activity;sid:84810375; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947273)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"39.90.146.150"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947273/; classtype:trojan-activity;sid:84810373; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947274)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.97.250.78"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947274/; classtype:trojan-activity;sid:84810374; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947271)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"59.97.250.78"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947271/; classtype:trojan-activity;sid:84810371; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947272)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.23.238.187"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947272/; classtype:trojan-activity;sid:84810372; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947270)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"96.246.230.97"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947270/; classtype:trojan-activity;sid:84810370; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947269)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.220.245.104"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947269/; classtype:trojan-activity;sid:84810369; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947268)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"118.250.1.203"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947268/; classtype:trojan-activity;sid:84810368; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947267)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.57.84.137"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947267/; classtype:trojan-activity;sid:84810367; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947266)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.55.223.246"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947266/; classtype:trojan-activity;sid:84810366; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947265)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.230.55.249"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947265/; classtype:trojan-activity;sid:84810365; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947263)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"91.190.84.93"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947263/; classtype:trojan-activity;sid:84810363; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947264)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"77.79.160.210"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947264/; classtype:trojan-activity;sid:84810364; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947262)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.28.135.254"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947262/; classtype:trojan-activity;sid:84810362; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947261)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.115.163.180"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947261/; classtype:trojan-activity;sid:84810361; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947260)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"118.250.1.203"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947260/; classtype:trojan-activity;sid:84810360; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947259)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.166.61.44"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947259/; classtype:trojan-activity;sid:84810359; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947258)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.179.238.153"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947258/; classtype:trojan-activity;sid:84810358; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947256)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.102.60.44"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947256/; classtype:trojan-activity;sid:84810356; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947257)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.235.51.97"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947257/; classtype:trojan-activity;sid:84810357; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947255)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"91.190.84.93"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947255/; classtype:trojan-activity;sid:84810355; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947254)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"113.230.55.249"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947254/; classtype:trojan-activity;sid:84810354; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947251)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.137.202.254"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947251/; classtype:trojan-activity;sid:84810351; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947252)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.232.238.114"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947252/; classtype:trojan-activity;sid:84810352; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947253)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.239.190.225"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947253/; classtype:trojan-activity;sid:84810353; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947250)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.57.84.137"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947250/; classtype:trojan-activity;sid:84810350; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947249)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.28.161.60"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947249/; classtype:trojan-activity;sid:84810349; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947248)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"124.161.116.2"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947248/; classtype:trojan-activity;sid:84810348; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947247)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.14.36.48"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947247/; classtype:trojan-activity;sid:84810347; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947245)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"120.28.161.60"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947245/; classtype:trojan-activity;sid:84810345; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947246)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"39.90.186.84"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947246/; classtype:trojan-activity;sid:84810346; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947244)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"180.190.243.27"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947244/; classtype:trojan-activity;sid:84810344; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947243)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.127.71.141"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947243/; classtype:trojan-activity;sid:84810343; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947242)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"103.172.186.195"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947242/; classtype:trojan-activity;sid:84810342; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947241)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.240.194.49"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947241/; classtype:trojan-activity;sid:84810341; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947237)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"45.5.88.205"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947237/; classtype:trojan-activity;sid:84810337; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947238)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"114.227.61.86"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947238/; classtype:trojan-activity;sid:84810338; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947239)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.185.242.157"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947239/; classtype:trojan-activity;sid:84810339; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947240)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.22.51.222"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947240/; classtype:trojan-activity;sid:84810340; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947233)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"119.185.242.157"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947233/; classtype:trojan-activity;sid:84810333; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947234)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.235.92.119"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947234/; classtype:trojan-activity;sid:84810334; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947235)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"61.137.202.254"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947235/; classtype:trojan-activity;sid:84810335; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947236)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"45.183.184.74"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947236/; classtype:trojan-activity;sid:84810336; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947232)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"39.40.186.7"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947232/; classtype:trojan-activity;sid:84810332; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947229)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"114.227.61.86"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947229/; classtype:trojan-activity;sid:84810329; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947230)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.137.85.203"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947230/; classtype:trojan-activity;sid:84810330; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947231)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.36.243.82"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947231/; classtype:trojan-activity;sid:84810331; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947220)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.52.233.42"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947220/; classtype:trojan-activity;sid:84810320; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947221)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.207.38.255"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947221/; classtype:trojan-activity;sid:84810321; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947222)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.28.194.92"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947222/; classtype:trojan-activity;sid:84810322; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947223)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.235.86.173"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947223/; classtype:trojan-activity;sid:84810323; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947224)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.5.16.160"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947224/; classtype:trojan-activity;sid:84810324; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947225)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.28.199.24"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947225/; classtype:trojan-activity;sid:84810325; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947226)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"120.86.145.22"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947226/; classtype:trojan-activity;sid:84810326; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947227)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.207.13.6"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947227/; classtype:trojan-activity;sid:84810327; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947228)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.207.13.6"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947228/; classtype:trojan-activity;sid:84810328; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947219)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.215.176.193"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947219/; classtype:trojan-activity;sid:84810319; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947218)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.227.134.163"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947218/; classtype:trojan-activity;sid:84810318; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947217)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.42.200.61"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947217/; classtype:trojan-activity;sid:84810317; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947216)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"160.176.254.189"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947216/; classtype:trojan-activity;sid:84810316; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947215)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"178.141.147.7"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_10; reference:url, urlhaus.abuse.ch/url/3947215/; classtype:trojan-activity;sid:84810315; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947214)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.180.155.243"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947214/; classtype:trojan-activity;sid:84810314; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947213)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.184.8.241"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947213/; classtype:trojan-activity;sid:84810313; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947212)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.121.227.48"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947212/; classtype:trojan-activity;sid:84810312; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947210)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.25.109.7"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947210/; classtype:trojan-activity;sid:84810310; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947211)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.104.214.25"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947211/; classtype:trojan-activity;sid:84810311; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947208)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.190.162.76"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947208/; classtype:trojan-activity;sid:84810308; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947209)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.238.143.132"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947209/; classtype:trojan-activity;sid:84810309; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947207)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.4.232.96"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947207/; classtype:trojan-activity;sid:84810307; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947206)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.113.204.7"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947206/; classtype:trojan-activity;sid:84810306; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947205)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.11.202.220"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947205/; classtype:trojan-activity;sid:84810305; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947204)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.180.148.16"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947204/; classtype:trojan-activity;sid:84810304; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947200)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"59.96.139.69"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947200/; classtype:trojan-activity;sid:84810300; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947201)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.23.238.1"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947201/; classtype:trojan-activity;sid:84810301; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947202)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.96.139.69"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947202/; classtype:trojan-activity;sid:84810302; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947203)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.43.47.191"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947203/; classtype:trojan-activity;sid:84810303; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947199)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.23.238.1"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947199/; classtype:trojan-activity;sid:84810299; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947197)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.54.57.22"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947197/; classtype:trojan-activity;sid:84810297; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947198)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.52.92.74"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947198/; classtype:trojan-activity;sid:84810298; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947196)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.113.200.213"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947196/; classtype:trojan-activity;sid:84810296; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947195)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"101.23.127.18"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947195/; classtype:trojan-activity;sid:84810295; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947194)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.224.148.231"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947194/; classtype:trojan-activity;sid:84810294; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947192)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.231.38.151"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947192/; classtype:trojan-activity;sid:84810292; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947193)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.224.148.231"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947193/; classtype:trojan-activity;sid:84810293; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947185)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.239.190.225"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947185/; classtype:trojan-activity;sid:84810285; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947186)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"120.28.194.92"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947186/; classtype:trojan-activity;sid:84810286; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947187)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.11.202.220"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947187/; classtype:trojan-activity;sid:84810287; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947188)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.184.69.39"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947188/; classtype:trojan-activity;sid:84810288; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947189)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.224.249.51"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947189/; classtype:trojan-activity;sid:84810289; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947190)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.235.86.173"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947190/; classtype:trojan-activity;sid:84810290; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947191)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.228.218.119"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947191/; classtype:trojan-activity;sid:84810291; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947184)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.141.127.20"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947184/; classtype:trojan-activity;sid:84810284; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947183)"; flow:established,from_client; content:"GET"; http_method; content:"/files-129312398/files/file_4b6b014c4c8f9ec9.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"91.92.242.236"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947183/; classtype:trojan-activity;sid:84810283; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947182)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"170.238.123.134"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947182/; classtype:trojan-activity;sid:84810282; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947181)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"170.238.123.134"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947181/; classtype:trojan-activity;sid:84810281; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947180)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"59.97.253.212"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947180/; classtype:trojan-activity;sid:84810280; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947175)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.239.228.53"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947175/; classtype:trojan-activity;sid:84810275; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947176)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"154.223.128.222"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947176/; classtype:trojan-activity;sid:84810276; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947177)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.239.228.53"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947177/; classtype:trojan-activity;sid:84810277; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947178)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"178.141.147.7"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947178/; classtype:trojan-activity;sid:84810278; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947179)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.221.33.248"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947179/; classtype:trojan-activity;sid:84810279; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947173)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.59.247.94"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947173/; classtype:trojan-activity;sid:84810273; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947174)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"110.136.60.67"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947174/; classtype:trojan-activity;sid:84810274; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947172)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"178.206.171.51"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947172/; classtype:trojan-activity;sid:84810272; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947171)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"121.202.142.137"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947171/; classtype:trojan-activity;sid:84810271; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947170)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.96.138.25"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947170/; classtype:trojan-activity;sid:84810270; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947169)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.5.153.79"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947169/; classtype:trojan-activity;sid:84810269; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947167)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.146.225.101"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947167/; classtype:trojan-activity;sid:84810267; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947168)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.5.153.79"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947168/; classtype:trojan-activity;sid:84810268; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947166)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.7.222.24"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947166/; classtype:trojan-activity;sid:84810266; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947165)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"110.136.10.85"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947165/; classtype:trojan-activity;sid:84810265; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947164)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.86.145.22"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947164/; classtype:trojan-activity;sid:84810264; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947161)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.22.51.222"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947161/; classtype:trojan-activity;sid:84810261; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947162)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.148.156.89"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947162/; classtype:trojan-activity;sid:84810262; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947163)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.185.150.241"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947163/; classtype:trojan-activity;sid:84810263; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947160)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"36.89.252.178"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947160/; classtype:trojan-activity;sid:84810260; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947159)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"36.89.252.178"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947159/; classtype:trojan-activity;sid:84810259; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947153)"; flow:established,from_client; content:"GET"; http_method; content:"/aarch64"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947153/; classtype:trojan-activity;sid:84810253; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947154)"; flow:established,from_client; content:"GET"; http_method; content:"/arm"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947154/; classtype:trojan-activity;sid:84810254; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947155)"; flow:established,from_client; content:"GET"; http_method; content:"/i486"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947155/; classtype:trojan-activity;sid:84810255; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947156)"; flow:established,from_client; content:"GET"; http_method; content:"/mipsel"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947156/; classtype:trojan-activity;sid:84810256; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947157)"; flow:established,from_client; content:"GET"; http_method; content:"/mips64"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947157/; classtype:trojan-activity;sid:84810257; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947158)"; flow:established,from_client; content:"GET"; http_method; content:"/spc"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"36.50.134.86"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947158/; classtype:trojan-activity;sid:84810258; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947151)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.8.25.70"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947151/; classtype:trojan-activity;sid:84810251; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947152)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.11.220.74"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947152/; classtype:trojan-activity;sid:84810252; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947147)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"188.38.158.163"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947147/; classtype:trojan-activity;sid:84810247; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947148)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"180.191.20.148"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947148/; classtype:trojan-activity;sid:84810248; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947149)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.112.41.50"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947149/; classtype:trojan-activity;sid:84810249; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947150)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"154.223.128.222"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947150/; classtype:trojan-activity;sid:84810250; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947146)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.127.111.22"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947146/; classtype:trojan-activity;sid:84810246; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947145)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.117.76.135"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947145/; classtype:trojan-activity;sid:84810245; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947144)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.44.215.216"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947144/; classtype:trojan-activity;sid:84810244; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947143)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"61.53.93.49"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947143/; classtype:trojan-activity;sid:84810243; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947142)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.112.41.50"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947142/; classtype:trojan-activity;sid:84810242; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947141)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.61.118.217"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947141/; classtype:trojan-activity;sid:84810241; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947140)"; flow:established,from_client; content:"GET"; http_method; content:"/bin/6fb78459bea435c0_remus.exe"; http_uri; depth:31; isdataat:!1,relative; nocase; content:"193.178.158.107"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947140/; classtype:trojan-activity;sid:84810240; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947138)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"180.191.228.88"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947138/; classtype:trojan-activity;sid:84810238; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947139)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.43.47.191"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947139/; classtype:trojan-activity;sid:84810239; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947137)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.49.44.200"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947137/; classtype:trojan-activity;sid:84810237; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947136)"; flow:established,from_client; content:"GET"; http_method; content:"/files-129312398/files/file_b3cc296623105902.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"91.92.242.236"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947136/; classtype:trojan-activity;sid:84810236; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947135)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"220.168.237.96"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947135/; classtype:trojan-activity;sid:84810235; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947134)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"220.168.237.96"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947134/; classtype:trojan-activity;sid:84810234; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947133)"; flow:established,from_client; content:"GET"; http_method; content:"/bin/4e984c028b501402_pyinfector.exe"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"193.178.158.57"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947133/; classtype:trojan-activity;sid:84810233; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947132)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.96.142.92"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947132/; classtype:trojan-activity;sid:84810232; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947131)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.4.232.96"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947131/; classtype:trojan-activity;sid:84810231; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947130)"; flow:established,from_client; content:"GET"; http_method; content:"/bin/6cbea551e8cbc1bb_global_8668.3380.0.0_install.exe"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"193.178.158.107"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947130/; classtype:trojan-activity;sid:84810230; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947129)"; flow:established,from_client; content:"GET"; http_method; content:"/bin/cc58391f679b5479_cryptoclipper.exe"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"193.178.158.57"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947129/; classtype:trojan-activity;sid:84810229; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947128)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.55.223.246"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947128/; classtype:trojan-activity;sid:84810228; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947127)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.119.186.189"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947127/; classtype:trojan-activity;sid:84810227; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947126)"; flow:established,from_client; content:"GET"; http_method; content:"/files-129312398/files/file_50f8dc1f79af08b7.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"91.92.242.236"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947126/; classtype:trojan-activity;sid:84810226; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947125)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"59.96.142.92"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947125/; classtype:trojan-activity;sid:84810225; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947124)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"103.81.239.59"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947124/; classtype:trojan-activity;sid:84810224; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947121)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"180.191.228.88"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947121/; classtype:trojan-activity;sid:84810221; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947122)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.47.113.53"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947122/; classtype:trojan-activity;sid:84810222; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947123)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"170.254.10.219"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947123/; classtype:trojan-activity;sid:84810223; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947119)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"130.0.43.154"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947119/; classtype:trojan-activity;sid:84810219; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947120)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.117.31.73"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947120/; classtype:trojan-activity;sid:84810220; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947118)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"196.189.197.131"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947118/; classtype:trojan-activity;sid:84810218; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947117)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"180.115.65.152"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947117/; classtype:trojan-activity;sid:84810217; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947116)"; flow:established,from_client; content:"GET"; http_method; content:"/phil/pdmjhdk.txt"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"www.tmcksa.com"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947116/; classtype:trojan-activity;sid:84810216; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947115)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"114.226.200.81"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947115/; classtype:trojan-activity;sid:84810215; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947114)"; flow:established,from_client; content:"GET"; http_method; content:"/new/odirrbk.txt"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"www.tmcksa.com"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947114/; classtype:trojan-activity;sid:84810214; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947113)"; flow:established,from_client; content:"GET"; http_method; content:"/img/2.jpg"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"64.224.17.115"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947113/; classtype:trojan-activity;sid:84810213; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947112)"; flow:established,from_client; content:"GET"; http_method; content:"/2.jpg"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"107.173.227.116"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947112/; classtype:trojan-activity;sid:84810212; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947111)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"216.126.80.56"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947111/; classtype:trojan-activity;sid:84810211; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947110)"; flow:established,from_client; content:"GET"; http_method; content:"/img_191633.png"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"micstndasap.world"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947110/; classtype:trojan-activity;sid:84810210; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947109)"; flow:established,from_client; content:"GET"; http_method; content:"/uu49yjw5"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"micstndasap.world"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947109/; classtype:trojan-activity;sid:84810209; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947108)"; flow:established,from_client; content:"GET"; http_method; content:"/img/img_194218.png"; http_uri; depth:19; isdataat:!1,relative; nocase; content:"ficus.in"; http_host; depth:8; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947108/; classtype:trojan-activity;sid:84810208; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947107)"; flow:established,from_client; content:"GET"; http_method; content:"/uc|3f|export=download|7c|26|7c|id=1_uzcqfkdbh4wncf92tw54h57khybkee4"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"drive.google.com"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947107/; classtype:trojan-activity;sid:84810207; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947105)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.123.192.144"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947105/; classtype:trojan-activity;sid:84810205; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947106)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"103.126.201.130"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947106/; classtype:trojan-activity;sid:84810206; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947104)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/588751559681376259/1558186147249922178/bundle_3.zip|3f|ex=6aca856f|7c|26|7c|is=6ac933ef|7c|26|7c|hm=caed6be90052bcc12e387eec9349a1d023e94c865e2da5a9964d07bad665b617|7c|26|7c|"; http_uri; depth:187; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947104/; classtype:trojan-activity;sid:84810204; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947102)"; flow:established,from_client; content:"GET"; http_method; content:"/3pnxr9p2"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"tronzadorasnng.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947102/; classtype:trojan-activity;sid:84810202; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947103)"; flow:established,from_client; content:"GET"; http_method; content:"/img_002333.png"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"tronzadorasnng.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947103/; classtype:trojan-activity;sid:84810203; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947101)"; flow:established,from_client; content:"GET"; http_method; content:"/img_005350.png"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"tronzadorasnng.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947101/; classtype:trojan-activity;sid:84810201; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947099)"; flow:established,from_client; content:"GET"; http_method; content:"/q196t8mz"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"tronzadorasnng.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947099/; classtype:trojan-activity;sid:84810199; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947100)"; flow:established,from_client; content:"GET"; http_method; content:"/07j45qil"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"tronzadorasnng.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947100/; classtype:trojan-activity;sid:84810200; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947097)"; flow:established,from_client; content:"GET"; http_method; content:"/nine23423423/fbi-openup/raw/refs/heads/main/servicemanager.exe"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947097/; classtype:trojan-activity;sid:84810197; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947098)"; flow:established,from_client; content:"GET"; http_method; content:"/nine23423423/reload1/raw/refs/heads/main/loader.exe"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947098/; classtype:trojan-activity;sid:84810198; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947096)"; flow:established,from_client; content:"GET"; http_method; content:"/nine23423423/reload1/raw/refs/heads/main/rtkauduservice.exe"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947096/; classtype:trojan-activity;sid:84810196; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947095)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"114.226.200.81"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947095/; classtype:trojan-activity;sid:84810195; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947093)"; flow:established,from_client; content:"GET"; http_method; content:"/szvazo0m"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"tronzadorasnng.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947093/; classtype:trojan-activity;sid:84810193; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947094)"; flow:established,from_client; content:"GET"; http_method; content:"/img_010548.png"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"tronzadorasnng.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947094/; classtype:trojan-activity;sid:84810194; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947091)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.155.200.85"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947091/; classtype:trojan-activity;sid:84810191; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947092)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"219.155.201.170"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947092/; classtype:trojan-activity;sid:84810192; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947090)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.232.179.113"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947090/; classtype:trojan-activity;sid:84810190; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947089)"; flow:established,from_client; content:"GET"; http_method; content:"/api/public/download/downloads/1791496929044-deathboundcraft.jar"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"deathboundcraft.com"; http_host; depth:19; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947089/; classtype:trojan-activity;sid:84810189; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947088)"; flow:established,from_client; content:"GET"; http_method; content:"/femboy.sh"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"156.226.174.251"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947088/; classtype:trojan-activity;sid:84810188; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947087)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/telnet/wget.sh"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947087/; classtype:trojan-activity;sid:84810187; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947086)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1553488282396926035/1558148289726124083/bundle_4.zip|3f|ex=6aca622d|7c|26|7c|is=6ac910ad|7c|26|7c|hm=a29f02ede4160432f5f0b145316bb617b54a372d514d06fa425c725e81f9d366|7c|26|7c|"; http_uri; depth:188; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947086/; classtype:trojan-activity;sid:84810186; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947085)"; flow:established,from_client; content:"GET"; http_method; content:"/7c961ce9-af0a-499d-ae15-a860978354a0/dupe-mod_1.0.0_0.jar|3f|download=true"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"filegoat.s3.de.io.cloud.ovh.net"; http_host; depth:31; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947085/; classtype:trojan-activity;sid:84810185; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947084)"; flow:established,from_client; content:"GET"; http_method; content:"/"; http_uri; depth:1; isdataat:!1,relative; nocase; content:"natashamohan.com"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947084/; classtype:trojan-activity;sid:84810184; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947082)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/payloads//wget.sh"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"85.137.53.167"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947082/; classtype:trojan-activity;sid:84810182; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947083)"; flow:established,from_client; content:"GET"; http_method; content:"/dep_kr29.sh"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947083/; classtype:trojan-activity;sid:84810183; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947080)"; flow:established,from_client; content:"GET"; http_method; content:"/cap/chored.cur"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"briannacorporation.com"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947080/; classtype:trojan-activity;sid:84810180; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947081)"; flow:established,from_client; content:"GET"; http_method; content:"/cap/ezlhodowq46.bin"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"briannacorporation.com"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947081/; classtype:trojan-activity;sid:84810181; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947079)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"212.54.86.171"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947079/; classtype:trojan-activity;sid:84810179; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947078)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.237.2.4"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947078/; classtype:trojan-activity;sid:84810178; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947077)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.202.215.185"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947077/; classtype:trojan-activity;sid:84810177; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947076)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"94.28.39.38"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947076/; classtype:trojan-activity;sid:84810176; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947075)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.53.88.16"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947075/; classtype:trojan-activity;sid:84810175; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947072)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"78.188.196.206"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947072/; classtype:trojan-activity;sid:84810172; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947073)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.52.4.108"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947073/; classtype:trojan-activity;sid:84810173; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947074)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.53.140.159"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947074/; classtype:trojan-activity;sid:84810174; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947071)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"41.216.226.217"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947071/; classtype:trojan-activity;sid:84810171; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947070)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.15.9.150"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947070/; classtype:trojan-activity;sid:84810170; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947069)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"112.198.238.18"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947069/; classtype:trojan-activity;sid:84810169; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947068)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"188.233.55.80"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947068/; classtype:trojan-activity;sid:84810168; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947067)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.190.229.115"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947067/; classtype:trojan-activity;sid:84810167; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947066)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.59.115.48"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947066/; classtype:trojan-activity;sid:84810166; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947065)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"220.164.23.33"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947065/; classtype:trojan-activity;sid:84810165; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947063)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.1.246.222"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947063/; classtype:trojan-activity;sid:84810163; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947064)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.228.41.178"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947064/; classtype:trojan-activity;sid:84810164; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947062)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.6.71.251"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947062/; classtype:trojan-activity;sid:84810162; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947060)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.232.238.114"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947060/; classtype:trojan-activity;sid:84810160; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947061)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.232.179.113"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947061/; classtype:trojan-activity;sid:84810161; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947059)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.237.253.32"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947059/; classtype:trojan-activity;sid:84810159; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947058)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.53.2.94"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947058/; classtype:trojan-activity;sid:84810158; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947057)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"112.248.1.204"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947057/; classtype:trojan-activity;sid:84810157; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947056)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"218.90.26.232"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947056/; classtype:trojan-activity;sid:84810156; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947055)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"59.96.137.214"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947055/; classtype:trojan-activity;sid:84810155; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947051)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.179.167.126"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947051/; classtype:trojan-activity;sid:84810151; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947052)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"220.201.171.252"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947052/; classtype:trojan-activity;sid:84810152; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947053)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.194.57.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947053/; classtype:trojan-activity;sid:84810153; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947054)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.194.57.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947054/; classtype:trojan-activity;sid:84810154; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947050)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"109.236.44.237"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947050/; classtype:trojan-activity;sid:84810150; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947049)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"112.248.113.211"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947049/; classtype:trojan-activity;sid:84810149; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947048)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.59.115.48"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947048/; classtype:trojan-activity;sid:84810148; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947047)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"109.236.44.237"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947047/; classtype:trojan-activity;sid:84810147; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947046)"; flow:established,from_client; content:"GET"; http_method; content:"/files-129312398/files/file_8dece6c27473f5d2.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"91.92.242.236"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947046/; classtype:trojan-activity;sid:84810146; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947044)"; flow:established,from_client; content:"GET"; http_method; content:"/goxlr.zip"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"downloads.go-xlr.com"; http_host; depth:20; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947044/; classtype:trojan-activity;sid:84810144; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947045)"; flow:established,from_client; content:"GET"; http_method; content:"/download/winhost"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"hardwood-studio-obviously-briefing.trycloudflare.com"; http_host; depth:52; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947045/; classtype:trojan-activity;sid:84810145; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947043)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.149.88.179"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947043/; classtype:trojan-activity;sid:84810143; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947042)"; flow:established,from_client; content:"GET"; http_method; content:"/riddents/eulencheats/raw/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947042/; classtype:trojan-activity;sid:84810142; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947041)"; flow:established,from_client; content:"GET"; http_method; content:"/wakkaflipps/fivem-server-unban/raw/head/silentum_spoofer.exe"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947041/; classtype:trojan-activity;sid:84810141; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947040)"; flow:established,from_client; content:"GET"; http_method; content:"/skannyraws/roblox-script-executor/raw/head/wave.exe"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947040/; classtype:trojan-activity;sid:84810140; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947038)"; flow:established,from_client; content:"GET"; http_method; content:"/washington0812/fivem-spoofer/raw/head/cfxbypass.exe"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947038/; classtype:trojan-activity;sid:84810138; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947039)"; flow:established,from_client; content:"GET"; http_method; content:"/scl/fi/f9xcikvn08lnp7oscsr8d/bundle.zip|3f|rlkey=jbzk4as9yhesbvbdqaz26u0hz|7c|26|7c|st=pb9wyr3r|7c|26|7c|dl=1"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"www.dropbox.com"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947039/; classtype:trojan-activity;sid:84810139; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947032)"; flow:established,from_client; content:"GET"; http_method; content:"/stehts/eulencheats/raw/head/loader.exe"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947032/; classtype:trojan-activity;sid:84810132; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947033)"; flow:established,from_client; content:"GET"; http_method; content:"/sfbbbvp9pg-cpu/swift-executor/raw/head/swift.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947033/; classtype:trojan-activity;sid:84810133; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947034)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.189.197.131"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947034/; classtype:trojan-activity;sid:84810134; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947035)"; flow:established,from_client; content:"GET"; http_method; content:"/stellacriss/eulencheats/raw/head/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947035/; classtype:trojan-activity;sid:84810135; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947036)"; flow:established,from_client; content:"GET"; http_method; content:"/vall3stecch/eulencheats/raw/head/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947036/; classtype:trojan-activity;sid:84810136; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947037)"; flow:established,from_client; content:"GET"; http_method; content:"/shademilliage/roblox-script-executor/raw/head/wave.exe"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947037/; classtype:trojan-activity;sid:84810137; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947031)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1558114186817437841/1558114355260948561/bundle.zip|3f|ex=6aca4292|7c|26|7c|is=6ac8f112|7c|26|7c|hm=e36aabee94a40f1c93398f5708dd71cd89f70a2b2e4f0233028f00621b5a5f2e|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947031/; classtype:trojan-activity;sid:84810131; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947030)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1558090546633904308/1558090607027683399/bundle.zip|3f|ex=6aca2c74|7c|26|7c|is=6ac8daf4|7c|26|7c|hm=f368654270984309f3f052b7969d1fdafb6fb00f448a68614de3746823cc20a4|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947030/; classtype:trojan-activity;sid:84810130; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947029)"; flow:established,from_client; content:"GET"; http_method; content:"/lanferry/fivem-server-unban/raw/head/silentum_spoofer.exe"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947029/; classtype:trojan-activity;sid:84810129; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947028)"; flow:established,from_client; content:"GET"; http_method; content:"/roverles/fivem-server-unban/raw/head/silentum_spoofer.exe"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947028/; classtype:trojan-activity;sid:84810128; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947021)"; flow:established,from_client; content:"GET"; http_method; content:"/archcalls/fivem-server-unban/raw/head/silentum_spoofer.exe"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947021/; classtype:trojan-activity;sid:84810121; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947022)"; flow:established,from_client; content:"GET"; http_method; content:"/hennisle/eulencheats/raw/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947022/; classtype:trojan-activity;sid:84810122; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947023)"; flow:established,from_client; content:"GET"; http_method; content:"/chamysooel/fivem-server-unban/raw/head/silentum_spoofer.exe"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947023/; classtype:trojan-activity;sid:84810123; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947024)"; flow:established,from_client; content:"GET"; http_method; content:"/sevv1lsy/eulencheats/raw/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947024/; classtype:trojan-activity;sid:84810124; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947025)"; flow:established,from_client; content:"GET"; http_method; content:"/elchapogta/redengine-fivem/raw/head/license.dll"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947025/; classtype:trojan-activity;sid:84810125; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947026)"; flow:established,from_client; content:"GET"; http_method; content:"/blestoff/monotone-hwid-spoofer/raw/head/monotone.exe"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947026/; classtype:trojan-activity;sid:84810126; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947027)"; flow:established,from_client; content:"GET"; http_method; content:"/l3mmn1ia/temp-spoofer-lifetime/raw/head/tempspoofer.exe"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947027/; classtype:trojan-activity;sid:84810127; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947009)"; flow:established,from_client; content:"GET"; http_method; content:"/candyblow/eulencheats/raw/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947009/; classtype:trojan-activity;sid:84810109; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947010)"; flow:established,from_client; content:"GET"; http_method; content:"/mineslance/eulencheats/raw/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947010/; classtype:trojan-activity;sid:84810110; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947011)"; flow:established,from_client; content:"GET"; http_method; content:"/cansiorly/eulencheats/raw/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947011/; classtype:trojan-activity;sid:84810111; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947012)"; flow:established,from_client; content:"GET"; http_method; content:"/gratelond/eulencheats/raw/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947012/; classtype:trojan-activity;sid:84810112; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947013)"; flow:established,from_client; content:"GET"; http_method; content:"/derrixhan/eulencheats/raw/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947013/; classtype:trojan-activity;sid:84810113; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947014)"; flow:established,from_client; content:"GET"; http_method; content:"/archrace/fivem-server-unban/raw/head/silentum_spoofer.exe"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947014/; classtype:trojan-activity;sid:84810114; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947015)"; flow:established,from_client; content:"GET"; http_method; content:"/deelcis/roblox-script-executor/raw/head/wave.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947015/; classtype:trojan-activity;sid:84810115; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947016)"; flow:established,from_client; content:"GET"; http_method; content:"/clatths/eulencheats/raw/head/loader.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947016/; classtype:trojan-activity;sid:84810116; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947017)"; flow:established,from_client; content:"GET"; http_method; content:"/mentall1s/eulencheats/raw/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947017/; classtype:trojan-activity;sid:84810117; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947018)"; flow:established,from_client; content:"GET"; http_method; content:"/lannher/eulencheats/raw/head/loader.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947018/; classtype:trojan-activity;sid:84810118; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947019)"; flow:established,from_client; content:"GET"; http_method; content:"/lierghs/eulencheats/raw/head/loader.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947019/; classtype:trojan-activity;sid:84810119; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947020)"; flow:established,from_client; content:"GET"; http_method; content:"/bonnylith/roblox-script-executor/raw/head/wave.exe"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947020/; classtype:trojan-activity;sid:84810120; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947000)"; flow:established,from_client; content:"GET"; http_method; content:"/aerosteeld/eulencheats/raw/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947000/; classtype:trojan-activity;sid:84810100; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947001)"; flow:established,from_client; content:"GET"; http_method; content:"/enzowipe/eulencheats/raw/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947001/; classtype:trojan-activity;sid:84810101; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947002)"; flow:established,from_client; content:"GET"; http_method; content:"/limmadays/eulencheats/raw/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947002/; classtype:trojan-activity;sid:84810102; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947003)"; flow:established,from_client; content:"GET"; http_method; content:"/adapp1t/eulencheats/raw/head/loader.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947003/; classtype:trojan-activity;sid:84810103; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947004)"; flow:established,from_client; content:"GET"; http_method; content:"/champywiss/roblox-script-executor/raw/head/wave.exe"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947004/; classtype:trojan-activity;sid:84810104; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947005)"; flow:established,from_client; content:"GET"; http_method; content:"/artlims/eulencheats/raw/head/loader.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947005/; classtype:trojan-activity;sid:84810105; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947006)"; flow:established,from_client; content:"GET"; http_method; content:"/download/epsi"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"emphasis-friday-even-administrator.trycloudflare.com"; http_host; depth:52; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947006/; classtype:trojan-activity;sid:84810106; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947007)"; flow:established,from_client; content:"GET"; http_method; content:"/cassiefinney/roblox-script-executor/raw/head/wave.exe"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947007/; classtype:trojan-activity;sid:84810107; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3947008)"; flow:established,from_client; content:"GET"; http_method; content:"/dirlands/eulencheats/raw/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3947008/; classtype:trojan-activity;sid:84810108; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946997)"; flow:established,from_client; content:"GET"; http_method; content:"/hannertmax/eulencheats/raw/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946997/; classtype:trojan-activity;sid:84810097; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946998)"; flow:established,from_client; content:"GET"; http_method; content:"/rarr1ve/eulencheats/raw/head/loader.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946998/; classtype:trojan-activity;sid:84810098; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946999)"; flow:established,from_client; content:"GET"; http_method; content:"/fansyhook/eulencheats/raw/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946999/; classtype:trojan-activity;sid:84810099; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946996)"; flow:established,from_client; content:"GET"; http_method; content:"/download/winhost"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"duo-strengthening-essex-ian.trycloudflare.com"; http_host; depth:45; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946996/; classtype:trojan-activity;sid:84810096; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946994)"; flow:established,from_client; content:"GET"; http_method; content:"/download/rvxupdate"; http_uri; depth:19; isdataat:!1,relative; nocase; content:"surround-tough-method-zinc.trycloudflare.com"; http_host; depth:44; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946994/; classtype:trojan-activity;sid:84810094; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946995)"; flow:established,from_client; content:"GET"; http_method; content:"/download/extupdate"; http_uri; depth:19; isdataat:!1,relative; nocase; content:"surround-tough-method-zinc.trycloudflare.com"; http_host; depth:44; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946995/; classtype:trojan-activity;sid:84810095; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946992)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"180.115.166.146"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946992/; classtype:trojan-activity;sid:84810092; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946993)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.52.35.140"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946993/; classtype:trojan-activity;sid:84810093; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946990)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.165.237.83"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946990/; classtype:trojan-activity;sid:84810090; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946991)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.14.36.48"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946991/; classtype:trojan-activity;sid:84810091; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946988)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"95.15.69.204"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946988/; classtype:trojan-activity;sid:84810088; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946989)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"95.15.69.204"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946989/; classtype:trojan-activity;sid:84810089; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946987)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.126.90.15"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946987/; classtype:trojan-activity;sid:84810087; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946986)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/x86"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"146.103.43.194"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946986/; classtype:trojan-activity;sid:84810086; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946985)"; flow:established,from_client; content:"GET"; http_method; content:"/mips"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946985/; classtype:trojan-activity;sid:84810085; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946980)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/ppc"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"146.103.43.194"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946980/; classtype:trojan-activity;sid:84810080; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946981)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/mips"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"146.103.43.194"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946981/; classtype:trojan-activity;sid:84810081; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946982)"; flow:established,from_client; content:"GET"; http_method; content:"/i686"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946982/; classtype:trojan-activity;sid:84810082; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946983)"; flow:established,from_client; content:"GET"; http_method; content:"/armv5l"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946983/; classtype:trojan-activity;sid:84810083; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946984)"; flow:established,from_client; content:"GET"; http_method; content:"/ppc"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946984/; classtype:trojan-activity;sid:84810084; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946979)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/arm6"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"146.103.43.194"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946979/; classtype:trojan-activity;sid:84810079; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946978)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"220.201.171.252"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946978/; classtype:trojan-activity;sid:84810078; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946975)"; flow:established,from_client; content:"GET"; http_method; content:"/arm5"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946975/; classtype:trojan-activity;sid:84810075; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946976)"; flow:established,from_client; content:"GET"; http_method; content:"/x86-64"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946976/; classtype:trojan-activity;sid:84810076; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946977)"; flow:established,from_client; content:"GET"; http_method; content:"/powerpc"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946977/; classtype:trojan-activity;sid:84810077; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946972)"; flow:established,from_client; content:"GET"; http_method; content:"/arm6"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946972/; classtype:trojan-activity;sid:84810072; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946973)"; flow:established,from_client; content:"GET"; http_method; content:"/armv6l"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946973/; classtype:trojan-activity;sid:84810073; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946974)"; flow:established,from_client; content:"GET"; http_method; content:"/arm4"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946974/; classtype:trojan-activity;sid:84810074; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946969)"; flow:established,from_client; content:"GET"; http_method; content:"/armv4l"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946969/; classtype:trojan-activity;sid:84810069; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946970)"; flow:established,from_client; content:"GET"; http_method; content:"/arm7"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946970/; classtype:trojan-activity;sid:84810070; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946971)"; flow:established,from_client; content:"GET"; http_method; content:"/armv7l"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946971/; classtype:trojan-activity;sid:84810071; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946968)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.138.148.198"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946968/; classtype:trojan-activity;sid:84810068; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946967)"; flow:established,from_client; content:"GET"; http_method; content:"/karinatt0/file/d5c3219dfcec05e58843f4c4b6e5bd78cbed634d/img_053520.png"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946967/; classtype:trojan-activity;sid:84810067; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946966)"; flow:established,from_client; content:"GET"; http_method; content:"/karinatt0/file/d5c3219dfcec05e58843f4c4b6e5bd78cbed634d/img_065109.png"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946966/; classtype:trojan-activity;sid:84810066; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946965)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"112.248.185.24"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946965/; classtype:trojan-activity;sid:84810065; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946964)"; flow:established,from_client; content:"GET"; http_method; content:"/karinatt0/file/d5c3219dfcec05e58843f4c4b6e5bd78cbed634d/img_015611.png"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946964/; classtype:trojan-activity;sid:84810064; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946963)"; flow:established,from_client; content:"GET"; http_method; content:"/dxnobk"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"rough-truth-e072.publicftpresend.workers.dev"; http_host; depth:44; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946963/; classtype:trojan-activity;sid:84810063; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946962)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.190.69.149"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946962/; classtype:trojan-activity;sid:84810062; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946960)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.121.81.61"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946960/; classtype:trojan-activity;sid:84810060; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946961)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.239.81.126"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946961/; classtype:trojan-activity;sid:84810061; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946959)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.117.76.136"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946959/; classtype:trojan-activity;sid:84810059; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946958)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.189.96.59"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946958/; classtype:trojan-activity;sid:84810058; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946957)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.206.139.244"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946957/; classtype:trojan-activity;sid:84810057; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946956)"; flow:established,from_client; content:"GET"; http_method; content:"/scl/fi/osoxrcdabdbir95t2nroe/bundle.zip|3f|rlkey=1yutmbqxcbs1xrqzqgvcxiu3j|7c|26|7c|st=xwbjhv80|7c|26|7c|dl=1"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"www.dropbox.com"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946956/; classtype:trojan-activity;sid:84810056; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946955)"; flow:established,from_client; content:"GET"; http_method; content:"/scl/fi/sxgw5icz1z9uybznqkrys/bundle.zip|3f|rlkey=5h9pn4ve617fzmcyzogt45xtx|7c|26|7c|st=kvy82hgi|7c|26|7c|dl=1"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"www.dropbox.com"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946955/; classtype:trojan-activity;sid:84810055; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946954)"; flow:established,from_client; content:"GET"; http_method; content:"/scl/fi/73j5kqqa8g7karyf1pl2f/bundle.zip|3f|rlkey=jj0d9efhorrjzys39jw7nuz2t|7c|26|7c|st=3yj3q2ti|7c|26|7c|dl=1"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"www.dropbox.com"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946954/; classtype:trojan-activity;sid:84810054; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946953)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1557133169877192734/1557824344401387601/bundle.zip|3f|ex=6ac9347a|7c|26|7c|is=6ac7e2fa|7c|26|7c|hm=2a5f26806d9c70a78cb91291d892ac9e9bc378a37ecbe88088c3af02e6eac519|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946953/; classtype:trojan-activity;sid:84810053; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946951)"; flow:established,from_client; content:"GET"; http_method; content:"/osmb.jar"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"www.osmb.net"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946951/; classtype:trojan-activity;sid:84810051; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946952)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1557944891575762984/1557945395277996133/bundle_2.zip|3f|ex=6ac9a537|7c|26|7c|is=6ac853b7|7c|26|7c|hm=6437d45cffc49ae16bc731d5aa1a09e76f71e006877171928c5be1ab33ccb6a5|7c|26|7c|"; http_uri; depth:188; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946952/; classtype:trojan-activity;sid:84810052; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946948)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1555273446441881600/1558075552412344351/bundle_1.zip|3f|ex=6aca1e6f|7c|26|7c|is=6ac8ccef|7c|26|7c|hm=c693cad9ae038f0226317909a6df51d7dc5c389429612a19c970e648b9d18a57|7c|26|7c|"; http_uri; depth:188; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946948/; classtype:trojan-activity;sid:84810048; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946949)"; flow:established,from_client; content:"GET"; http_method; content:"/mindgone/eulencheats-fivem/-/raw/main/loader.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946949/; classtype:trojan-activity;sid:84810049; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946950)"; flow:established,from_client; content:"GET"; http_method; content:"/mysterybless/fortnite-ragdoll-v2-privcheat-including-softaim-esp-wallhack-triggerbot-and-more/-/raw/main/loader.exe"; http_uri; depth:116; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946950/; classtype:trojan-activity;sid:84810050; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946947)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"58.47.66.250"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946947/; classtype:trojan-activity;sid:84810047; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946944)"; flow:established,from_client; content:"GET"; http_method; content:"/devilsprite/xeno-executor/-/raw/main/xenoexecutor.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946944/; classtype:trojan-activity;sid:84810044; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946945)"; flow:established,from_client; content:"GET"; http_method; content:"/amillyrow/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946945/; classtype:trojan-activity;sid:84810045; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946946)"; flow:established,from_client; content:"GET"; http_method; content:"/prsur"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"qq.kipsharijan.cfd"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946946/; classtype:trojan-activity;sid:84810046; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946942)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1519428468599951424/1558057878890221588/bundle.zip|3f|ex=6aca0df9|7c|26|7c|is=6ac8bc79|7c|26|7c|hm=c778990da8edb87cc9953a1997b9b988223e71f0dfb4c2aba8061880522c9145|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946942/; classtype:trojan-activity;sid:84810042; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946940)"; flow:established,from_client; content:"GET"; http_method; content:"/osbot.jar"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"osbot.net"; http_host; depth:9; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946940/; classtype:trojan-activity;sid:84810040; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946941)"; flow:established,from_client; content:"GET"; http_method; content:"/stylyshconc/swift-executor/raw/head/swift.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946941/; classtype:trojan-activity;sid:84810041; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946936)"; flow:established,from_client; content:"GET"; http_method; content:"/spazedurk/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946936/; classtype:trojan-activity;sid:84810036; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946937)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.215.55.107"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946937/; classtype:trojan-activity;sid:84810037; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946938)"; flow:established,from_client; content:"GET"; http_method; content:"/voicesinari/warzone-dominator/raw/head/loader.exe"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946938/; classtype:trojan-activity;sid:84810038; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946939)"; flow:established,from_client; content:"GET"; http_method; content:"/hallermsy/exodus-larp-tool/raw/head/exodus.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946939/; classtype:trojan-activity;sid:84810039; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946934)"; flow:established,from_client; content:"GET"; http_method; content:"/shellmadys/dma-spoofer/raw/head/dma_spoofer.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946934/; classtype:trojan-activity;sid:84810034; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946935)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1557151123666763786/1557507870440947742/bundle4.zip|3f|backend=b2|7c|26|7c|ex=6ac80dbd|7c|26|7c|is=6ac6bc3d|7c|26|7c|hm=9d9216ccb4b0698324afcbda3711d2f532ca976e1175c12edcde0fa068066530|7c|26|7c|"; http_uri; depth:207; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946935/; classtype:trojan-activity;sid:84810035; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946930)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1555611683316305982/1555632019642515546/bundle.zip|3f|ex=6ac13ab7|7c|26|7c|is=6abfe937|7c|26|7c|hm=f78314b38fb572c2ace948cb0068c4d71cd7493b505d47672174a69bbf272fb7|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946930/; classtype:trojan-activity;sid:84810030; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946931)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1553488282396926035/1556771267728638023/bundle_3.zip|3f|ex=6ac55fb9|7c|26|7c|is=6ac40e39|7c|26|7c|hm=efa2b25ba5e817917e130e8f8c8c8a8ca7bcce83e035074538c4aaafa4e32461|7c|26|7c|"; http_uri; depth:188; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946931/; classtype:trojan-activity;sid:84810031; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946932)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1557151123666763786/1557506286818689064/bundle3.zip|3f|backend=b2|7c|26|7c|ex=6ac80c43|7c|26|7c|is=6ac6bac3|7c|26|7c|hm=9eb18ad120f69df8b9c032049a833bd4d50ef669d2dd08aef02bd98b364960f4|7c|26|7c|"; http_uri; depth:207; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946932/; classtype:trojan-activity;sid:84810032; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946933)"; flow:established,from_client; content:"GET"; http_method; content:"/redhenns/xeno-executor/raw/head/xeno.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946933/; classtype:trojan-activity;sid:84810033; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946928)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/993236836841422971/1557641602426478682/bundle.zip|3f|ex=6ac88a49|7c|26|7c|is=6ac738c9|7c|26|7c|hm=8151c0d825b59b075c4eef4a239d409cd405aed1c4d3d1fa6b5ca015822e7ebc|7c|26|7c|"; http_uri; depth:185; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946928/; classtype:trojan-activity;sid:84810028; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946929)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1303859286715269124/1555998705453371482/bundle.zip|3f|ex=6ac29038|7c|26|7c|is=6ac13eb8|7c|26|7c|hm=e6fb2b369bb78799a75be531a2c6c500f194ac5c31d5b46f4441e4ceff52219d|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946929/; classtype:trojan-activity;sid:84810029; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946923)"; flow:established,from_client; content:"GET"; http_method; content:"/channyl9/fivem-external-cheat/raw/head/loader.exe"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946923/; classtype:trojan-activity;sid:84810023; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946924)"; flow:established,from_client; content:"GET"; http_method; content:"/b3at1z/umbrella-hwid-tool/raw/head/umbrella/umbrella.exe"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946924/; classtype:trojan-activity;sid:84810024; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946925)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1554540331729428512/1554540941933813840/bundle.zip|3f|ex=6abd4292|7c|26|7c|is=6abbf112|7c|26|7c|hm=0982d18aca5a6a5abe4f1a55e15681e17db3f66655954508c0c3f0d79c2c9ff8|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946925/; classtype:trojan-activity;sid:84810025; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946926)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1557540794322255916/1557547273469304852/docsend.exe|3f|ex=6ac8326f|7c|26|7c|is=6ac6e0ef|7c|26|7c|hm=a63457051c583761f1cec716699654537fd53498bb136ce8a68644779594d09a|7c|26|7c|"; http_uri; depth:187; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946926/; classtype:trojan-activity;sid:84810026; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946927)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/752745910659842148/1557611729121312829/bundle_2.zip|3f|ex=6ac86e77|7c|26|7c|is=6ac71cf7|7c|26|7c|hm=0f48e7d8f63791c99c8fdfabde15419c91e5e5741110a3a362d68fa7639748b0|7c|26|7c|"; http_uri; depth:187; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946927/; classtype:trojan-activity;sid:84810027; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946921)"; flow:established,from_client; content:"GET"; http_method; content:"/scl/fi/gya8fwl2yikrrmfhvwc8g/bundle-7.zip|3f|rlkey=l7t8znbg4rgmv33z87ztomvnc|7c|26|7c|st=pa02mzfs|7c|26|7c|dl=1"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"www.dropbox.com"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946921/; classtype:trojan-activity;sid:84810021; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946922)"; flow:established,from_client; content:"GET"; http_method; content:"/jehhn1l/fivem-spoofer/raw/head/cfxbypass.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946922/; classtype:trojan-activity;sid:84810022; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946918)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/447108878963048458/1556697211415568496/bundle.zip|3f|ex=6ac51ac1|7c|26|7c|is=6ac3c941|7c|26|7c|hm=d582c4a45d48757252452c2d9050d0cf82209b833f1915a3d912056a63588578|7c|26|7c|"; http_uri; depth:185; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946918/; classtype:trojan-activity;sid:84810018; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946919)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1554681741015392331/1554985138352562306/bundle.zip|3f|ex=6abee043|7c|26|7c|is=6abd8ec3|7c|26|7c|hm=56c329e3ff2f1efec739365225dedb588e208d1c7016d5bd7ff3aaecb7b35495|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946919/; classtype:trojan-activity;sid:84810019; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946920)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1557035542208712774/1557698845453058160/bundle.zip|3f|ex=6ac8bf99|7c|26|7c|is=6ac76e19|7c|26|7c|hm=9fcc0058789315b7cea328c7d341ba2e05fe16aaa8d1d524f2acb68c3e507fe4|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946920/; classtype:trojan-activity;sid:84810020; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946916)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.42.71.239"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946916/; classtype:trojan-activity;sid:84810016; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946917)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.239.81.126"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946917/; classtype:trojan-activity;sid:84810017; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946914)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.140.156.6"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946914/; classtype:trojan-activity;sid:84810014; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946915)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.140.156.6"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946915/; classtype:trojan-activity;sid:84810015; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946913)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.51.129.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946913/; classtype:trojan-activity;sid:84810013; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946912)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.177.29.94"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946912/; classtype:trojan-activity;sid:84810012; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946911)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.51.129.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946911/; classtype:trojan-activity;sid:84810011; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946910)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"218.16.164.2"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946910/; classtype:trojan-activity;sid:84810010; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946909)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.57.180.68"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946909/; classtype:trojan-activity;sid:84810009; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946908)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"112.240.255.10"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946908/; classtype:trojan-activity;sid:84810008; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946907)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.157.2.171"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946907/; classtype:trojan-activity;sid:84810007; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946906)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"218.16.164.2"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946906/; classtype:trojan-activity;sid:84810006; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946905)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.113.191.78"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946905/; classtype:trojan-activity;sid:84810005; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946904)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.219.118.7"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946904/; classtype:trojan-activity;sid:84810004; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946903)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"39.90.186.84"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946903/; classtype:trojan-activity;sid:84810003; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946902)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.154.155.199"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946902/; classtype:trojan-activity;sid:84810002; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946901)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.141.142.185"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946901/; classtype:trojan-activity;sid:84810001; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946900)"; flow:established,from_client; content:"GET"; http_method; content:"/g.php"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"1rvrental.com"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946900/; classtype:trojan-activity;sid:84810000; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946899)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.a"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"196.189.68.239"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946899/; classtype:trojan-activity;sid:84809999; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946898)"; flow:established,from_client; content:"GET"; http_method; content:"/tadashi.arm7"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"5.83.134.80"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946898/; classtype:trojan-activity;sid:84809998; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946897)"; flow:established,from_client; content:"GET"; http_method; content:"/r"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"1rvrental.com"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946897/; classtype:trojan-activity;sid:84809997; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946896)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.141.142.185"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946896/; classtype:trojan-activity;sid:84809996; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946895)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"216.126.80.56"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946895/; classtype:trojan-activity;sid:84809995; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946891)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"218.24.252.208"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946891/; classtype:trojan-activity;sid:84809991; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946892)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.137.146.217"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946892/; classtype:trojan-activity;sid:84809992; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946893)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.121.227.48"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946893/; classtype:trojan-activity;sid:84809993; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946894)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.137.190.185"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946894/; classtype:trojan-activity;sid:84809994; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946884)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.221.145.214"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946884/; classtype:trojan-activity;sid:84809984; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946885)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.189.130.28"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946885/; classtype:trojan-activity;sid:84809985; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946886)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.126.241.26"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946886/; classtype:trojan-activity;sid:84809986; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946887)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.188.75.58"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946887/; classtype:trojan-activity;sid:84809987; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946888)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"196.188.75.58"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946888/; classtype:trojan-activity;sid:84809988; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946889)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"201.159.91.2"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946889/; classtype:trojan-activity;sid:84809989; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946890)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"203.204.193.202"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946890/; classtype:trojan-activity;sid:84809990; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946883)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"45.148.148.31"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946883/; classtype:trojan-activity;sid:84809983; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946882)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"39.65.211.9"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946882/; classtype:trojan-activity;sid:84809982; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946881)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.224.11.100"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946881/; classtype:trojan-activity;sid:84809981; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946880)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.148.87.105"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946880/; classtype:trojan-activity;sid:84809980; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946879)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.224.31.7"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946879/; classtype:trojan-activity;sid:84809979; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946878)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.40.130.70"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946878/; classtype:trojan-activity;sid:84809978; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946876)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"112.248.185.24"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946876/; classtype:trojan-activity;sid:84809976; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946877)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.230.34.172"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946877/; classtype:trojan-activity;sid:84809977; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946875)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.148.87.105"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946875/; classtype:trojan-activity;sid:84809975; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946873)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.237.2.4"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946873/; classtype:trojan-activity;sid:84809973; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946874)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.43.241.16"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946874/; classtype:trojan-activity;sid:84809974; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946872)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.224.31.7"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946872/; classtype:trojan-activity;sid:84809972; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946871)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.227.190.233"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946871/; classtype:trojan-activity;sid:84809971; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946870)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.55.32.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946870/; classtype:trojan-activity;sid:84809970; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946869)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"119.179.253.121"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946869/; classtype:trojan-activity;sid:84809969; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946868)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.238.170.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946868/; classtype:trojan-activity;sid:84809968; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946867)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.165.87.230"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946867/; classtype:trojan-activity;sid:84809967; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946866)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"109.194.28.77"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946866/; classtype:trojan-activity;sid:84809966; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946865)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.227.190.233"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946865/; classtype:trojan-activity;sid:84809965; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946864)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/x86"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"172.245.106.144"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946864/; classtype:trojan-activity;sid:84809964; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946863)"; flow:established,from_client; content:"GET"; http_method; content:"/d/432936b3a0439572/o/nnnnnede/init.sh2"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"195.178.110.29"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946863/; classtype:trojan-activity;sid:84809963; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946862)"; flow:established,from_client; content:"GET"; http_method; content:"/d/432936b3a0439572/o/nnnnnede/init.sh"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"195.178.110.29"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946862/; classtype:trojan-activity;sid:84809962; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946861)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.48.145.92"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946861/; classtype:trojan-activity;sid:84809961; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946860)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"103.31.103.204"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946860/; classtype:trojan-activity;sid:84809960; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946859)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"117.88.227.121"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946859/; classtype:trojan-activity;sid:84809959; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946858)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.48.145.92"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946858/; classtype:trojan-activity;sid:84809958; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946856)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.214.23.166"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946856/; classtype:trojan-activity;sid:84809956; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946857)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.225.159.210"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946857/; classtype:trojan-activity;sid:84809957; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946853)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"103.31.103.204"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946853/; classtype:trojan-activity;sid:84809953; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946854)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.44.215.216"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946854/; classtype:trojan-activity;sid:84809954; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946855)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"124.6.167.113"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946855/; classtype:trojan-activity;sid:84809955; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946852)"; flow:established,from_client; content:"GET"; http_method; content:"/wj0s.sh4"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"103.238.235.250"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946852/; classtype:trojan-activity;sid:84809952; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946850)"; flow:established,from_client; content:"GET"; http_method; content:"/wj0s.arm64"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"103.238.235.250"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946850/; classtype:trojan-activity;sid:84809950; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946851)"; flow:established,from_client; content:"GET"; http_method; content:"/wj0s.arm7"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"103.238.235.250"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946851/; classtype:trojan-activity;sid:84809951; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946847)"; flow:established,from_client; content:"GET"; http_method; content:"/wj0s.i686"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"103.238.235.250"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946847/; classtype:trojan-activity;sid:84809947; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946848)"; flow:established,from_client; content:"GET"; http_method; content:"/wj0s.x86_64"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"103.238.235.250"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946848/; classtype:trojan-activity;sid:84809948; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946849)"; flow:established,from_client; content:"GET"; http_method; content:"/wj0s.mips"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"103.238.235.250"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946849/; classtype:trojan-activity;sid:84809949; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946842)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sh4"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"146.103.43.194"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946842/; classtype:trojan-activity;sid:84809942; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946843)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/arm"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"146.103.43.194"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946843/; classtype:trojan-activity;sid:84809943; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946844)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/m68k"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"146.103.43.194"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946844/; classtype:trojan-activity;sid:84809944; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946845)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/spc"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"146.103.43.194"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946845/; classtype:trojan-activity;sid:84809945; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946846)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/arm7"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"146.103.43.194"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946846/; classtype:trojan-activity;sid:84809946; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946841)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/mpsl"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"146.103.43.194"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946841/; classtype:trojan-activity;sid:84809941; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946840)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.119.186.189"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946840/; classtype:trojan-activity;sid:84809940; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946839)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.116.122.168"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946839/; classtype:trojan-activity;sid:84809939; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946838)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"101.59.79.119"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946838/; classtype:trojan-activity;sid:84809938; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946837)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.18.101.216"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946837/; classtype:trojan-activity;sid:84809937; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946836)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.18.101.216"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946836/; classtype:trojan-activity;sid:84809936; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946835)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.221.98.30"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946835/; classtype:trojan-activity;sid:84809935; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946832)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.23.236.49"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946832/; classtype:trojan-activity;sid:84809932; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946833)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"165.98.243.83"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946833/; classtype:trojan-activity;sid:84809933; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946834)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"164.163.26.124"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946834/; classtype:trojan-activity;sid:84809934; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946831)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"89.43.223.227"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946831/; classtype:trojan-activity;sid:84809931; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946830)"; flow:established,from_client; content:"GET"; http_method; content:"/files-129312398/files/file_146f8720a4894bd8.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"91.92.242.236"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946830/; classtype:trojan-activity;sid:84809930; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946829)"; flow:established,from_client; content:"GET"; http_method; content:"/x86_64"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"130.12.180.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946829/; classtype:trojan-activity;sid:84809929; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946828)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.m"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"109.236.46.199"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946828/; classtype:trojan-activity;sid:84809928; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946827)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.116.122.168"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946827/; classtype:trojan-activity;sid:84809927; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946826)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.230.51.234"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946826/; classtype:trojan-activity;sid:84809926; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946825)"; flow:established,from_client; content:"GET"; http_method; content:"/uc|3f|export=download|7c|26|7c|id=1l_cku7gnkfeuffiu2vesvhdzjbsvzjmx"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"drive.google.com"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946825/; classtype:trojan-activity;sid:84809925; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946824)"; flow:established,from_client; content:"GET"; http_method; content:"/uc|3f|export=download|7c|26|7c|id=14oekhhfto_xx6x0db-qpzwul_arxfhio"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"drive.google.com"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946824/; classtype:trojan-activity;sid:84809924; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946823)"; flow:established,from_client; content:"GET"; http_method; content:"/asset/update.dat"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"stanarcservice.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946823/; classtype:trojan-activity;sid:84809923; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946822)"; flow:established,from_client; content:"GET"; http_method; content:"/payload/18d92fc0860cc33a.bin"; http_uri; depth:29; isdataat:!1,relative; nocase; content:"stanarcservice.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946822/; classtype:trojan-activity;sid:84809922; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946821)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.58.177.21"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946821/; classtype:trojan-activity;sid:84809921; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946820)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.63.78.29"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946820/; classtype:trojan-activity;sid:84809920; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946819)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"219.157.242.174"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946819/; classtype:trojan-activity;sid:84809919; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946818)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/mpsl"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"178.128.125.255"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946818/; classtype:trojan-activity;sid:84809918; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946804)"; flow:established,from_client; content:"GET"; http_method; content:"/mogh739/metrics-agents/-/raw/main/agent-install.sh"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946804/; classtype:trojan-activity;sid:84809904; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946805)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.m"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"203.177.28.149"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946805/; classtype:trojan-activity;sid:84809905; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946806)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/x86_64"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"178.128.125.255"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946806/; classtype:trojan-activity;sid:84809906; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946807)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/mips"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"178.128.125.255"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946807/; classtype:trojan-activity;sid:84809907; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946808)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/arm5"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"178.128.125.255"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946808/; classtype:trojan-activity;sid:84809908; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946809)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/arm7"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"178.128.125.255"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946809/; classtype:trojan-activity;sid:84809909; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946810)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/ppc"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"178.128.125.255"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946810/; classtype:trojan-activity;sid:84809910; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946811)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/x86"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"178.128.125.255"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946811/; classtype:trojan-activity;sid:84809911; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946812)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/i686"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"178.128.125.255"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946812/; classtype:trojan-activity;sid:84809912; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946813)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/spc"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"178.128.125.255"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946813/; classtype:trojan-activity;sid:84809913; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946814)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/arm"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"178.128.125.255"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946814/; classtype:trojan-activity;sid:84809914; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946815)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sh4"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"178.128.125.255"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946815/; classtype:trojan-activity;sid:84809915; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946816)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/m68k"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"178.128.125.255"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946816/; classtype:trojan-activity;sid:84809916; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946817)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/arm6"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"178.128.125.255"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946817/; classtype:trojan-activity;sid:84809917; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946803)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"103.249.199.5"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946803/; classtype:trojan-activity;sid:84809903; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946802)"; flow:established,from_client; content:"GET"; http_method; content:"/payload/1ay0eknhal4o/6lpiz8.sh"; http_uri; depth:31; isdataat:!1,relative; nocase; content:"83.168.110.123"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946802/; classtype:trojan-activity;sid:84809902; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946795)"; flow:established,from_client; content:"GET"; http_method; content:"/mogh739/metrics-agents/-/raw/main/collector-linux-arm64"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946795/; classtype:trojan-activity;sid:84809895; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946796)"; flow:established,from_client; content:"GET"; http_method; content:"/mogh739/metrics-agents/-/raw/main/collector-linux-x64"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946796/; classtype:trojan-activity;sid:84809896; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946797)"; flow:established,from_client; content:"GET"; http_method; content:"/mogh739/static-assets/-/raw/main/collector-linux-arm64"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946797/; classtype:trojan-activity;sid:84809897; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946798)"; flow:established,from_client; content:"GET"; http_method; content:"/mogh739/static-assets/-/raw/main/agentd-linux-arm64"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946798/; classtype:trojan-activity;sid:84809898; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946799)"; flow:established,from_client; content:"GET"; http_method; content:"/mogh739/metrics-agents/-/raw/main/agentd-linux-x64"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946799/; classtype:trojan-activity;sid:84809899; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946800)"; flow:established,from_client; content:"GET"; http_method; content:"/mogh739/static-assets/-/raw/main/agent-install.sh"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946800/; classtype:trojan-activity;sid:84809900; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946801)"; flow:established,from_client; content:"GET"; http_method; content:"/mogh739/static-assets/-/raw/main/collector-linux-x64"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946801/; classtype:trojan-activity;sid:84809901; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946794)"; flow:established,from_client; content:"GET"; http_method; content:"/mogh739/metrics-agents/-/raw/main/agentd-linux-arm64"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946794/; classtype:trojan-activity;sid:84809894; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946793)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.m"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"111.14.169.186"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946793/; classtype:trojan-activity;sid:84809893; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946791)"; flow:established,from_client; content:"GET"; http_method; content:"/mogh739/static-assets/-/raw/main/agentd-linux-x64"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946791/; classtype:trojan-activity;sid:84809891; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946792)"; flow:established,from_client; content:"GET"; http_method; content:"/wj0s.arm"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"103.238.235.250"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946792/; classtype:trojan-activity;sid:84809892; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946790)"; flow:established,from_client; content:"GET"; http_method; content:"/mogh739/metrics-agents/-/raw/main/collector-legacy-linux-x64"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946790/; classtype:trojan-activity;sid:84809890; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946787)"; flow:established,from_client; content:"GET"; http_method; content:"/payload.sh"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"109.123.243.121"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946787/; classtype:trojan-activity;sid:84809887; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946788)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.m"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"112.198.179.93"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946788/; classtype:trojan-activity;sid:84809888; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946789)"; flow:established,from_client; content:"GET"; http_method; content:"/lol.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"103.238.235.250"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946789/; classtype:trojan-activity;sid:84809889; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946785)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1557973486176043018/1557974426660905030/bettersurvival.jar|3f|ex=6ac9c041|7c|26|7c|is=6ac86ec1|7c|26|7c|hm=9436b20ab3fc47cc6db0eb41943bc7cf49a68f1bf0b10e89fa539b3aa9e38e55|7c|26|7c|"; http_uri; depth:194; isdataat:!1,relative; nocase; content:"media.discordapp.net"; http_host; depth:20; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946785/; classtype:trojan-activity;sid:84809885; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946786)"; flow:established,from_client; content:"GET"; http_method; content:"/eclipse.mips"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"w5q.eu"; http_host; depth:6; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946786/; classtype:trojan-activity;sid:84809886; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946784)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.116.115.77"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946784/; classtype:trojan-activity;sid:84809884; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946783)"; flow:established,from_client; content:"GET"; http_method; content:"/api/download.php"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"qwfwhg4.lol"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946783/; classtype:trojan-activity;sid:84809883; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946782)"; flow:established,from_client; content:"GET"; http_method; content:"/telnet.sh"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"103.238.235.250"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946782/; classtype:trojan-activity;sid:84809882; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946781)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.120.3.227"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946781/; classtype:trojan-activity;sid:84809881; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946780)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.215.89.229"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946780/; classtype:trojan-activity;sid:84809880; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946779)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"113.230.51.234"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946779/; classtype:trojan-activity;sid:84809879; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946778)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"105.225.46.193"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946778/; classtype:trojan-activity;sid:84809878; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946777)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.123.192.144"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946777/; classtype:trojan-activity;sid:84809877; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946776)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.120.3.227"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946776/; classtype:trojan-activity;sid:84809876; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946775)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.141.112.238"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946775/; classtype:trojan-activity;sid:84809875; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946774)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.238.210.76"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946774/; classtype:trojan-activity;sid:84809874; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946772)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.230.54.79"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946772/; classtype:trojan-activity;sid:84809872; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946773)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.238.210.76"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946773/; classtype:trojan-activity;sid:84809873; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946771)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.9.203.45"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946771/; classtype:trojan-activity;sid:84809871; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946770)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.11.75.204"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946770/; classtype:trojan-activity;sid:84809870; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946769)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"180.103.174.195"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946769/; classtype:trojan-activity;sid:84809869; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946768)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"116.140.187.113"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946768/; classtype:trojan-activity;sid:84809868; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946767)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.191.104.40"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946767/; classtype:trojan-activity;sid:84809867; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946766)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.9.203.45"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946766/; classtype:trojan-activity;sid:84809866; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946765)"; flow:established,from_client; content:"GET"; http_method; content:"/files-129312398/files/file_27539cb69c52484f.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"91.92.242.236"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946765/; classtype:trojan-activity;sid:84809865; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946764)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.215.215.163"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946764/; classtype:trojan-activity;sid:84809864; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946763)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.4.127.9"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946763/; classtype:trojan-activity;sid:84809863; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946762)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"37.48.148.108"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946762/; classtype:trojan-activity;sid:84809862; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946760)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.186.181.226"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946760/; classtype:trojan-activity;sid:84809860; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946761)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.156.119.243"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946761/; classtype:trojan-activity;sid:84809861; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946759)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.177.29.94"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946759/; classtype:trojan-activity;sid:84809859; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946758)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.138.216.248"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946758/; classtype:trojan-activity;sid:84809858; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946757)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.127.120.193"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946757/; classtype:trojan-activity;sid:84809857; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946756)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"103.249.199.5"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946756/; classtype:trojan-activity;sid:84809856; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946753)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"151.237.28.235"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946753/; classtype:trojan-activity;sid:84809853; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946754)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"196.191.104.40"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946754/; classtype:trojan-activity;sid:84809854; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946755)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.165.86.250"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946755/; classtype:trojan-activity;sid:84809855; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946750)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"160.176.170.101"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946750/; classtype:trojan-activity;sid:84809850; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946751)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"210.97.100.192"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946751/; classtype:trojan-activity;sid:84809851; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946752)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.117.146.213"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946752/; classtype:trojan-activity;sid:84809852; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946749)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.45.65.12"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946749/; classtype:trojan-activity;sid:84809849; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946748)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.22.8.194"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946748/; classtype:trojan-activity;sid:84809848; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946746)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.224.67.128"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946746/; classtype:trojan-activity;sid:84809846; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946747)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.215.176.193"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946747/; classtype:trojan-activity;sid:84809847; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946743)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.215.215.163"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946743/; classtype:trojan-activity;sid:84809843; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946744)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.7.122.114"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946744/; classtype:trojan-activity;sid:84809844; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946745)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.52.173.208"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946745/; classtype:trojan-activity;sid:84809845; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946742)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.45.65.12"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946742/; classtype:trojan-activity;sid:84809842; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946741)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"59.58.106.125"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946741/; classtype:trojan-activity;sid:84809841; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946740)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.146.225.101"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946740/; classtype:trojan-activity;sid:84809840; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946736)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.225.46.193"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946736/; classtype:trojan-activity;sid:84809836; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946737)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"114.198.242.174"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946737/; classtype:trojan-activity;sid:84809837; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946738)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"164.163.25.203"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946738/; classtype:trojan-activity;sid:84809838; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946739)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.11.133.35"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946739/; classtype:trojan-activity;sid:84809839; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946735)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"2.85.58.246"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946735/; classtype:trojan-activity;sid:84809835; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946734)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.56.152.220"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946734/; classtype:trojan-activity;sid:84809834; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946733)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.112.28.160"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946733/; classtype:trojan-activity;sid:84809833; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946732)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.121.81.61"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946732/; classtype:trojan-activity;sid:84809832; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946729)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.151.248.162"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946729/; classtype:trojan-activity;sid:84809829; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946730)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"103.190.23.91"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946730/; classtype:trojan-activity;sid:84809830; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946731)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.114.33.57"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946731/; classtype:trojan-activity;sid:84809831; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946728)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"116.209.183.7"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946728/; classtype:trojan-activity;sid:84809828; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946726)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"196.151.248.162"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946726/; classtype:trojan-activity;sid:84809826; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946727)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.127.120.193"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946727/; classtype:trojan-activity;sid:84809827; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946725)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.56.152.220"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946725/; classtype:trojan-activity;sid:84809825; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946723)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.6.56.231"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946723/; classtype:trojan-activity;sid:84809823; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946724)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.85.162.250"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946724/; classtype:trojan-activity;sid:84809824; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946722)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.7.84.109"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946722/; classtype:trojan-activity;sid:84809822; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946721)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.7.84.109"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946721/; classtype:trojan-activity;sid:84809821; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946720)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.224.67.128"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946720/; classtype:trojan-activity;sid:84809820; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946719)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.63.51.182"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946719/; classtype:trojan-activity;sid:84809819; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946718)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"183.35.50.185"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946718/; classtype:trojan-activity;sid:84809818; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946717)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.127.26.104"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946717/; classtype:trojan-activity;sid:84809817; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946716)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"196.191.233.24"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946716/; classtype:trojan-activity;sid:84809816; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946715)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"220.161.100.72"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946715/; classtype:trojan-activity;sid:84809815; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946714)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"219.156.63.39"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946714/; classtype:trojan-activity;sid:84809814; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946713)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.156.63.39"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946713/; classtype:trojan-activity;sid:84809813; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946711)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.191.233.24"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946711/; classtype:trojan-activity;sid:84809811; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946712)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"103.111.23.12"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946712/; classtype:trojan-activity;sid:84809812; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946710)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"218.16.164.236"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946710/; classtype:trojan-activity;sid:84809810; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946709)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.47.218.42"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946709/; classtype:trojan-activity;sid:84809809; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946705)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/morte.m68k"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"176.65.139.231"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946705/; classtype:trojan-activity;sid:84809805; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946706)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/morte.ppc"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"176.65.139.231"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946706/; classtype:trojan-activity;sid:84809806; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946707)"; flow:established,from_client; content:"GET"; http_method; content:"/mirai.mips"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"176.65.139.231"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946707/; classtype:trojan-activity;sid:84809807; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946708)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/morte.sh4"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"176.65.139.231"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946708/; classtype:trojan-activity;sid:84809808; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946701)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/morte.x86"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"176.65.139.231"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946701/; classtype:trojan-activity;sid:84809801; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946702)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/morte.arc"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"176.65.139.231"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946702/; classtype:trojan-activity;sid:84809802; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946703)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/morte.mpsl"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"176.65.139.231"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946703/; classtype:trojan-activity;sid:84809803; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946704)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/morte.mips"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"176.65.139.231"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946704/; classtype:trojan-activity;sid:84809804; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946693)"; flow:established,from_client; content:"GET"; http_method; content:"/mirai.arm5n"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"176.65.139.231"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946693/; classtype:trojan-activity;sid:84809793; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946694)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/morte.arm"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"176.65.139.231"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946694/; classtype:trojan-activity;sid:84809794; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946695)"; flow:established,from_client; content:"GET"; http_method; content:"/mirai.arm"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"176.65.139.231"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946695/; classtype:trojan-activity;sid:84809795; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946696)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/morte.arm5"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"176.65.139.231"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946696/; classtype:trojan-activity;sid:84809796; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946697)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/morte.i686"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"176.65.139.231"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946697/; classtype:trojan-activity;sid:84809797; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946698)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/morte.arm7"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"176.65.139.231"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946698/; classtype:trojan-activity;sid:84809798; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946699)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/morte.spc"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"176.65.139.231"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946699/; classtype:trojan-activity;sid:84809799; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946700)"; flow:established,from_client; content:"GET"; http_method; content:"/mirai.x86"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"176.65.139.231"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946700/; classtype:trojan-activity;sid:84809800; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946692)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"218.16.164.236"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946692/; classtype:trojan-activity;sid:84809792; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946691)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"41.216.226.77"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946691/; classtype:trojan-activity;sid:84809791; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946689)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.127.50.108"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946689/; classtype:trojan-activity;sid:84809789; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946690)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.127.76.40"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946690/; classtype:trojan-activity;sid:84809790; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946688)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.186.138.183"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946688/; classtype:trojan-activity;sid:84809788; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946687)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.196.0.230"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946687/; classtype:trojan-activity;sid:84809787; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946686)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.127.251.163"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946686/; classtype:trojan-activity;sid:84809786; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946685)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.127.254.114"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946685/; classtype:trojan-activity;sid:84809785; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946684)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.230.18.23"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946684/; classtype:trojan-activity;sid:84809784; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946683)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"39.63.157.145"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946683/; classtype:trojan-activity;sid:84809783; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946682)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.141.133.202"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946682/; classtype:trojan-activity;sid:84809782; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946681)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.228.247.173"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946681/; classtype:trojan-activity;sid:84809781; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946680)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.235.92.138"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946680/; classtype:trojan-activity;sid:84809780; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946679)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.46.198.140"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946679/; classtype:trojan-activity;sid:84809779; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946678)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.238.170.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946678/; classtype:trojan-activity;sid:84809778; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946677)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.57.164.151"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946677/; classtype:trojan-activity;sid:84809777; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946676)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.186.138.183"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946676/; classtype:trojan-activity;sid:84809776; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946675)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"193.163.187.224"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_09; reference:url, urlhaus.abuse.ch/url/3946675/; classtype:trojan-activity;sid:84809775; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946674)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.180.141.251"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946674/; classtype:trojan-activity;sid:84809774; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946672)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.23.77.13"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946672/; classtype:trojan-activity;sid:84809772; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946673)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.214.58.89"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946673/; classtype:trojan-activity;sid:84809773; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946671)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"180.190.238.89"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946671/; classtype:trojan-activity;sid:84809771; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946670)"; flow:established,from_client; content:"GET"; http_method; content:"/files/7782139129/sqrgijn.exe"; http_uri; depth:29; isdataat:!1,relative; nocase; content:"62.60.226.140"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946670/; classtype:trojan-activity;sid:84809770; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946669)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"180.191.49.27"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946669/; classtype:trojan-activity;sid:84809769; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946668)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"108.170.136.155"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946668/; classtype:trojan-activity;sid:84809768; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946667)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.52.20.56"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946667/; classtype:trojan-activity;sid:84809767; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946666)"; flow:established,from_client; content:"GET"; http_method; content:"/files-129312398/files/file_7d6e0a8ed54f5bd4.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"91.92.242.236"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946666/; classtype:trojan-activity;sid:84809766; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946665)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"112.238.27.166"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946665/; classtype:trojan-activity;sid:84809765; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946664)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.189.157.12"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946664/; classtype:trojan-activity;sid:84809764; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946663)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.9.84.231"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946663/; classtype:trojan-activity;sid:84809763; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946662)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.189.176.51"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946662/; classtype:trojan-activity;sid:84809762; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946661)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.85.134.36"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946661/; classtype:trojan-activity;sid:84809761; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946660)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"193.187.101.209"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946660/; classtype:trojan-activity;sid:84809760; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946659)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.229.175.66"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946659/; classtype:trojan-activity;sid:84809759; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946658)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.48.144.79"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946658/; classtype:trojan-activity;sid:84809758; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946657)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"103.111.23.12"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946657/; classtype:trojan-activity;sid:84809757; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946656)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.116.115.77"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946656/; classtype:trojan-activity;sid:84809756; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946655)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.127.179.145"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946655/; classtype:trojan-activity;sid:84809755; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946654)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.48.144.79"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946654/; classtype:trojan-activity;sid:84809754; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946653)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.137.158.220"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946653/; classtype:trojan-activity;sid:84809753; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946652)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"109.236.46.199"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946652/; classtype:trojan-activity;sid:84809752; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946651)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.157.242.174"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946651/; classtype:trojan-activity;sid:84809751; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946648)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.14.222.197"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946648/; classtype:trojan-activity;sid:84809748; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946649)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.141.120.45"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946649/; classtype:trojan-activity;sid:84809749; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946650)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.219.118.7"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946650/; classtype:trojan-activity;sid:84809750; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946647)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"180.190.202.146"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946647/; classtype:trojan-activity;sid:84809747; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946646)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.sh4"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"104.64.0.199"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946646/; classtype:trojan-activity;sid:84809746; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946638)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.mips"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"104.64.0.199"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946638/; classtype:trojan-activity;sid:84809738; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946639)"; flow:established,from_client; content:"GET"; http_method; content:"//violet.x86"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"172.245.106.144"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946639/; classtype:trojan-activity;sid:84809739; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946640)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.mpsl"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"104.64.0.199"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946640/; classtype:trojan-activity;sid:84809740; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946641)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.ppc"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"104.64.0.199"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946641/; classtype:trojan-activity;sid:84809741; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946642)"; flow:established,from_client; content:"GET"; http_method; content:"//violet.ppc"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"172.245.106.144"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946642/; classtype:trojan-activity;sid:84809742; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946643)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arm5"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"104.64.0.199"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946643/; classtype:trojan-activity;sid:84809743; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946644)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arm7"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"104.64.0.199"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946644/; classtype:trojan-activity;sid:84809744; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946645)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.x86_64"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"104.64.0.199"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946645/; classtype:trojan-activity;sid:84809745; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946629)"; flow:established,from_client; content:"GET"; http_method; content:"//violet.mpsl"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"172.245.106.144"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946629/; classtype:trojan-activity;sid:84809729; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946630)"; flow:established,from_client; content:"GET"; http_method; content:"//violet.m68k"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"172.245.106.144"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946630/; classtype:trojan-activity;sid:84809730; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946631)"; flow:established,from_client; content:"GET"; http_method; content:"//violet.arm6"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"172.245.106.144"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946631/; classtype:trojan-activity;sid:84809731; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946632)"; flow:established,from_client; content:"GET"; http_method; content:"//violet.arm"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"172.245.106.144"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946632/; classtype:trojan-activity;sid:84809732; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946633)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arm"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"104.64.0.199"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946633/; classtype:trojan-activity;sid:84809733; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946634)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.i686"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"104.64.0.199"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946634/; classtype:trojan-activity;sid:84809734; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946635)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.m68k"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"104.64.0.199"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946635/; classtype:trojan-activity;sid:84809735; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946636)"; flow:established,from_client; content:"GET"; http_method; content:"//violet.mips"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"172.245.106.144"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946636/; classtype:trojan-activity;sid:84809736; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946637)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arm6"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"104.64.0.199"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946637/; classtype:trojan-activity;sid:84809737; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946627)"; flow:established,from_client; content:"GET"; http_method; content:"//violet.arm7"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"172.245.106.144"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946627/; classtype:trojan-activity;sid:84809727; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946628)"; flow:established,from_client; content:"GET"; http_method; content:"//violet.i586"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"172.245.106.144"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946628/; classtype:trojan-activity;sid:84809728; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946624)"; flow:established,from_client; content:"GET"; http_method; content:"//violet.sparc"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"172.245.106.144"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946624/; classtype:trojan-activity;sid:84809724; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946625)"; flow:established,from_client; content:"GET"; http_method; content:"//violet.sh4"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"172.245.106.144"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946625/; classtype:trojan-activity;sid:84809725; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946626)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.sparc"; http_uri; depth:22; isdataat:!1,relative; nocase; content:"104.64.0.199"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946626/; classtype:trojan-activity;sid:84809726; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946620)"; flow:established,from_client; content:"GET"; http_method; content:"//violet.arc"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"172.245.106.144"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946620/; classtype:trojan-activity;sid:84809720; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946621)"; flow:established,from_client; content:"GET"; http_method; content:"//violet.x86_64"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"172.245.106.144"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946621/; classtype:trojan-activity;sid:84809721; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946622)"; flow:established,from_client; content:"GET"; http_method; content:"//violet.mips64"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"172.245.106.144"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946622/; classtype:trojan-activity;sid:84809722; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946623)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.mips64"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"104.64.0.199"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946623/; classtype:trojan-activity;sid:84809723; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946619)"; flow:established,from_client; content:"GET"; http_method; content:"//violet.arm5"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"172.245.106.144"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946619/; classtype:trojan-activity;sid:84809719; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946618)"; flow:established,from_client; content:"GET"; http_method; content:"/fast/putty.exe"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"23.132.164.15"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946618/; classtype:trojan-activity;sid:84809718; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946616)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/px86"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"94.154.43.203"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946616/; classtype:trojan-activity;sid:84809716; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946617)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/mpsl"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"94.154.43.203"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946617/; classtype:trojan-activity;sid:84809717; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946615)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.220.145.39"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946615/; classtype:trojan-activity;sid:84809715; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946614)"; flow:established,from_client; content:"GET"; http_method; content:"/file/5zdr3wzj48j8odd/setup_package_(key=2088).zip/file"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"www.mediafire.com"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946614/; classtype:trojan-activity;sid:84809714; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946612)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.49.193.168"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946612/; classtype:trojan-activity;sid:84809712; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946613)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"36.89.252.178"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946613/; classtype:trojan-activity;sid:84809713; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946611)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.220.145.39"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946611/; classtype:trojan-activity;sid:84809711; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946610)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.224.199.236"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946610/; classtype:trojan-activity;sid:84809710; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946609)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.230.23.74"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946609/; classtype:trojan-activity;sid:84809709; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946608)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"180.103.174.195"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946608/; classtype:trojan-activity;sid:84809708; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946607)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.40.86.102"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946607/; classtype:trojan-activity;sid:84809707; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946600)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_x86_64"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"15.207.188.221"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946600/; classtype:trojan-activity;sid:84809700; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946601)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.ppc"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"77.90.14.60"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946601/; classtype:trojan-activity;sid:84809701; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946602)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.arm7"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"77.90.14.60"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946602/; classtype:trojan-activity;sid:84809702; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946603)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.mpsl"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"77.90.14.60"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946603/; classtype:trojan-activity;sid:84809703; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946604)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.arm"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"176.65.132.207"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946604/; classtype:trojan-activity;sid:84809704; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946605)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.arc"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"77.90.14.60"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946605/; classtype:trojan-activity;sid:84809705; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946606)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.m68k"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"77.90.14.60"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946606/; classtype:trojan-activity;sid:84809706; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946577)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"219.157.52.153"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946577/; classtype:trojan-activity;sid:84809677; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946578)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.ppc"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"176.65.132.207"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946578/; classtype:trojan-activity;sid:84809678; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946579)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.arm7"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"176.65.132.207"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946579/; classtype:trojan-activity;sid:84809679; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946580)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.sh4"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"176.65.132.207"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946580/; classtype:trojan-activity;sid:84809680; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946581)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.mpsl"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"176.65.132.207"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946581/; classtype:trojan-activity;sid:84809681; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946582)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.i686"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"176.65.132.207"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946582/; classtype:trojan-activity;sid:84809682; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946583)"; flow:established,from_client; content:"GET"; http_method; content:"/main_arm5"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"94.154.43.211"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946583/; classtype:trojan-activity;sid:84809683; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946584)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.arc"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"176.65.132.207"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946584/; classtype:trojan-activity;sid:84809684; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946585)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.x86"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"176.65.132.207"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946585/; classtype:trojan-activity;sid:84809685; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946586)"; flow:established,from_client; content:"GET"; http_method; content:"/main_m68k"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"94.154.43.211"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946586/; classtype:trojan-activity;sid:84809686; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946587)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.mips"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"176.65.132.207"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946587/; classtype:trojan-activity;sid:84809687; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946588)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.arm5"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"176.65.132.207"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946588/; classtype:trojan-activity;sid:84809688; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946589)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.i486"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"176.65.132.207"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946589/; classtype:trojan-activity;sid:84809689; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946590)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.arm6"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"176.65.132.207"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946590/; classtype:trojan-activity;sid:84809690; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946591)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.x86_64"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"176.65.132.207"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946591/; classtype:trojan-activity;sid:84809691; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946592)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.spc"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"176.65.132.207"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946592/; classtype:trojan-activity;sid:84809692; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946593)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.m68k"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"176.65.132.207"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946593/; classtype:trojan-activity;sid:84809693; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946594)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.x86"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"77.90.14.60"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946594/; classtype:trojan-activity;sid:84809694; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946595)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.sh4"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"77.90.14.60"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946595/; classtype:trojan-activity;sid:84809695; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946596)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.arm6"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"77.90.14.60"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946596/; classtype:trojan-activity;sid:84809696; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946597)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.arm"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"77.90.14.60"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946597/; classtype:trojan-activity;sid:84809697; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946598)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.arm5"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"77.90.14.60"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946598/; classtype:trojan-activity;sid:84809698; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946599)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.mips"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"77.90.14.60"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946599/; classtype:trojan-activity;sid:84809699; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946566)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_lite_arm8"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"123.56.0.201"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946566/; classtype:trojan-activity;sid:84809666; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946567)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_lite_x86-64"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"123.56.0.201"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946567/; classtype:trojan-activity;sid:84809667; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946568)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_agent_x86_64"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"123.56.0.201"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946568/; classtype:trojan-activity;sid:84809668; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946569)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_agent_mips64le"; http_uri; depth:19; isdataat:!1,relative; nocase; content:"123.56.0.201"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946569/; classtype:trojan-activity;sid:84809669; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946570)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_agent_mipsle"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"123.56.0.201"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946570/; classtype:trojan-activity;sid:84809670; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946571)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_agent_arm64"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"123.56.0.201"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946571/; classtype:trojan-activity;sid:84809671; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946572)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_lite_arm"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"123.56.0.201"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946572/; classtype:trojan-activity;sid:84809672; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946573)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_agent_c.c"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"123.56.0.201"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946573/; classtype:trojan-activity;sid:84809673; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946574)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_lite_mips"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"123.56.0.201"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946574/; classtype:trojan-activity;sid:84809674; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946575)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_lite_armv7l"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"123.56.0.201"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946575/; classtype:trojan-activity;sid:84809675; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946576)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_lite_arm64"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"123.56.0.201"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946576/; classtype:trojan-activity;sid:84809676; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946564)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_lite.c"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"123.56.0.201"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946564/; classtype:trojan-activity;sid:84809664; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946565)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_agent_armv7"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"123.56.0.201"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946565/; classtype:trojan-activity;sid:84809665; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946554)"; flow:established,from_client; content:"GET"; http_method; content:"/zhr_debug_mips"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"79.238.78.248"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946554/; classtype:trojan-activity;sid:84809654; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946555)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_i686"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946555/; classtype:trojan-activity;sid:84809655; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946556)"; flow:established,from_client; content:"GET"; http_method; content:"/z3hir.mpsl"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"79.238.78.248"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946556/; classtype:trojan-activity;sid:84809656; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946557)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_armv6"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"170.64.142.108"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946557/; classtype:trojan-activity;sid:84809657; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946558)"; flow:established,from_client; content:"GET"; http_method; content:"/z3hir.x86_64"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"79.238.78.248"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946558/; classtype:trojan-activity;sid:84809658; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946559)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946559/; classtype:trojan-activity;sid:84809659; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946560)"; flow:established,from_client; content:"GET"; http_method; content:"/bot.x86_64"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"217.60.241.5"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946560/; classtype:trojan-activity;sid:84809660; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946561)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_mipsel"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"170.64.142.108"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946561/; classtype:trojan-activity;sid:84809661; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946562)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_i686.gz"; http_uri; depth:19; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946562/; classtype:trojan-activity;sid:84809662; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946563)"; flow:established,from_client; content:"GET"; http_method; content:"/bot.i386"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"217.60.241.5"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946563/; classtype:trojan-activity;sid:84809663; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946546)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_mips64el"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"170.64.142.108"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946546/; classtype:trojan-activity;sid:84809646; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946547)"; flow:established,from_client; content:"GET"; http_method; content:"/z3hir.mipsel"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"79.238.78.248"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946547/; classtype:trojan-activity;sid:84809647; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946548)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_mipsel.gz"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946548/; classtype:trojan-activity;sid:84809648; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946549)"; flow:established,from_client; content:"GET"; http_method; content:"/tadashi.x86"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"13.140.176.180"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946549/; classtype:trojan-activity;sid:84809649; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946550)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_armel.gz"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946550/; classtype:trojan-activity;sid:84809650; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946551)"; flow:established,from_client; content:"GET"; http_method; content:"/tadashi.ppc"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"13.140.176.180"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946551/; classtype:trojan-activity;sid:84809651; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946552)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_arm64.gz"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946552/; classtype:trojan-activity;sid:84809652; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946553)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_armv5tel"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946553/; classtype:trojan-activity;sid:84809653; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946545)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_powerpc"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"170.64.142.108"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946545/; classtype:trojan-activity;sid:84809645; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946544)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_m68k"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"170.64.142.108"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946544/; classtype:trojan-activity;sid:84809644; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946537)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_i486"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"170.64.142.108"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946537/; classtype:trojan-activity;sid:84809637; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946538)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_i686"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"170.64.142.108"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946538/; classtype:trojan-activity;sid:84809638; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946539)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_np.gz"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946539/; classtype:trojan-activity;sid:84809639; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946540)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_riscv64"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"15.207.188.221"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946540/; classtype:trojan-activity;sid:84809640; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946541)"; flow:established,from_client; content:"GET"; http_method; content:"/tadashi.android.arm64"; http_uri; depth:22; isdataat:!1,relative; nocase; content:"13.140.176.180"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946541/; classtype:trojan-activity;sid:84809641; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946542)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_i386"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946542/; classtype:trojan-activity;sid:84809642; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946543)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_armhf.gz"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946543/; classtype:trojan-activity;sid:84809643; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946506)"; flow:established,from_client; content:"GET"; http_method; content:"/tadashi.arm8"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"13.140.176.180"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946506/; classtype:trojan-activity;sid:84809606; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946507)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_i386.gz"; http_uri; depth:19; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946507/; classtype:trojan-activity;sid:84809607; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946508)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_armv5tel.gz"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946508/; classtype:trojan-activity;sid:84809608; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946509)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_armv6l.gz"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946509/; classtype:trojan-activity;sid:84809609; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946510)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_arm"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"15.207.188.221"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946510/; classtype:trojan-activity;sid:84809610; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946511)"; flow:established,from_client; content:"GET"; http_method; content:"/z3hir.arm"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"79.238.78.248"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946511/; classtype:trojan-activity;sid:84809611; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946512)"; flow:established,from_client; content:"GET"; http_method; content:"/z3hir.armv7l"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"79.238.78.248"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946512/; classtype:trojan-activity;sid:84809612; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946513)"; flow:established,from_client; content:"GET"; http_method; content:"/z3hir.sh4"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"79.238.78.248"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946513/; classtype:trojan-activity;sid:84809613; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946514)"; flow:established,from_client; content:"GET"; http_method; content:"/bot.mipsel"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"217.60.241.5"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946514/; classtype:trojan-activity;sid:84809614; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946515)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_aarch64"; http_uri; depth:19; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946515/; classtype:trojan-activity;sid:84809615; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946516)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent.gz"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946516/; classtype:trojan-activity;sid:84809616; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946517)"; flow:established,from_client; content:"GET"; http_method; content:"/z3hir.i686"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"79.238.78.248"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946517/; classtype:trojan-activity;sid:84809617; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946518)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_aarch64.gz"; http_uri; depth:22; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946518/; classtype:trojan-activity;sid:84809618; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946519)"; flow:established,from_client; content:"GET"; http_method; content:"/z3hir.mips"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"79.238.78.248"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946519/; classtype:trojan-activity;sid:84809619; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946520)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_arm"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946520/; classtype:trojan-activity;sid:84809620; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946521)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_armv7"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946521/; classtype:trojan-activity;sid:84809621; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946522)"; flow:established,from_client; content:"GET"; http_method; content:"/z3hir.m68k"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"79.238.78.248"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946522/; classtype:trojan-activity;sid:84809622; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946523)"; flow:established,from_client; content:"GET"; http_method; content:"/zhr_debug"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"79.238.78.248"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946523/; classtype:trojan-activity;sid:84809623; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946524)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_mipsel"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"15.207.188.221"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946524/; classtype:trojan-activity;sid:84809624; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946525)"; flow:established,from_client; content:"GET"; http_method; content:"/z3hir.x86"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"79.238.78.248"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946525/; classtype:trojan-activity;sid:84809625; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946526)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_armv5l"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"170.64.142.108"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946526/; classtype:trojan-activity;sid:84809626; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946527)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_mips64"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"170.64.142.108"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946527/; classtype:trojan-activity;sid:84809627; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946528)"; flow:established,from_client; content:"GET"; http_method; content:"/tadashi.android.arm"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"13.140.176.180"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946528/; classtype:trojan-activity;sid:84809628; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946529)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent.tar"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946529/; classtype:trojan-activity;sid:84809629; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946530)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_mips64"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"15.207.188.221"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946530/; classtype:trojan-activity;sid:84809630; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946531)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_armv6l"; http_uri; depth:18; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946531/; classtype:trojan-activity;sid:84809631; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946532)"; flow:established,from_client; content:"GET"; http_method; content:"/bot.mips"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"217.60.241.5"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946532/; classtype:trojan-activity;sid:84809632; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946533)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_aarch64"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"15.207.188.221"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946533/; classtype:trojan-activity;sid:84809633; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946534)"; flow:established,from_client; content:"GET"; http_method; content:"/bot.arm64"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"217.60.241.5"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946534/; classtype:trojan-activity;sid:84809634; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946535)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_amd64"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946535/; classtype:trojan-activity;sid:84809635; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946536)"; flow:established,from_client; content:"GET"; http_method; content:"/z3hir.aarch64"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"79.238.78.248"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946536/; classtype:trojan-activity;sid:84809636; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946505)"; flow:established,from_client; content:"GET"; http_method; content:"/frps"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"108.137.82.100"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946505/; classtype:trojan-activity;sid:84809605; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946504)"; flow:established,from_client; content:"GET"; http_method; content:"/frpc_linux_arm"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"108.137.82.100"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946504/; classtype:trojan-activity;sid:84809604; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946468)"; flow:established,from_client; content:"GET"; http_method; content:"/tadashi.arm7"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"13.140.176.180"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946468/; classtype:trojan-activity;sid:84809568; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946469)"; flow:established,from_client; content:"GET"; http_method; content:"/tadashi.arm64"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"13.140.176.180"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946469/; classtype:trojan-activity;sid:84809569; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946470)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_aarch64"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"170.64.142.108"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946470/; classtype:trojan-activity;sid:84809570; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946471)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_arm"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"170.64.142.108"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946471/; classtype:trojan-activity;sid:84809571; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946472)"; flow:established,from_client; content:"GET"; http_method; content:"/z3hir.amd64"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"79.238.78.248"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946472/; classtype:trojan-activity;sid:84809572; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946473)"; flow:established,from_client; content:"GET"; http_method; content:"/z3hir.i586"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"79.238.78.248"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946473/; classtype:trojan-activity;sid:84809573; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946474)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_amd64.gz"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946474/; classtype:trojan-activity;sid:84809574; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946475)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_powerpc64le"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"15.207.188.221"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946475/; classtype:trojan-activity;sid:84809575; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946476)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_np"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946476/; classtype:trojan-activity;sid:84809576; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946477)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_powerpc"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"15.207.188.221"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946477/; classtype:trojan-activity;sid:84809577; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946478)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_m68k"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"15.207.188.221"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946478/; classtype:trojan-activity;sid:84809578; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946479)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_mips"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"15.207.188.221"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946479/; classtype:trojan-activity;sid:84809579; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946480)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_armv6"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946480/; classtype:trojan-activity;sid:84809580; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946481)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_armv6.gz"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946481/; classtype:trojan-activity;sid:84809581; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946482)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_arm64"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946482/; classtype:trojan-activity;sid:84809582; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946483)"; flow:established,from_client; content:"GET"; http_method; content:"/bot.x86"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"217.60.241.5"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946483/; classtype:trojan-activity;sid:84809583; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946484)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_mips"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946484/; classtype:trojan-activity;sid:84809584; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946485)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_mipsel"; http_uri; depth:18; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946485/; classtype:trojan-activity;sid:84809585; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946486)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_x86_64.gz"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946486/; classtype:trojan-activity;sid:84809586; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946487)"; flow:established,from_client; content:"GET"; http_method; content:"/z3hir.i386"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"79.238.78.248"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946487/; classtype:trojan-activity;sid:84809587; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946488)"; flow:established,from_client; content:"GET"; http_method; content:"/z3hir.ppc"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"79.238.78.248"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946488/; classtype:trojan-activity;sid:84809588; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946489)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_armv7l"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"170.64.142.108"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946489/; classtype:trojan-activity;sid:84809589; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946490)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_armhf"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946490/; classtype:trojan-activity;sid:84809590; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946491)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_armv7.gz"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946491/; classtype:trojan-activity;sid:84809591; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946492)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_armel"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946492/; classtype:trojan-activity;sid:84809592; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946493)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_armv7l.gz"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946493/; classtype:trojan-activity;sid:84809593; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946494)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_arm.gz"; http_uri; depth:18; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946494/; classtype:trojan-activity;sid:84809594; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946495)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_mips.gz"; http_uri; depth:19; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946495/; classtype:trojan-activity;sid:84809595; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946496)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_x86_64"; http_uri; depth:18; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946496/; classtype:trojan-activity;sid:84809596; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946497)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_sh4"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"15.207.188.221"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946497/; classtype:trojan-activity;sid:84809597; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946498)"; flow:established,from_client; content:"GET"; http_method; content:"/z3hir.x64"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"79.238.78.248"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946498/; classtype:trojan-activity;sid:84809598; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946499)"; flow:established,from_client; content:"GET"; http_method; content:"/z3hir.arm7"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"79.238.78.248"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946499/; classtype:trojan-activity;sid:84809599; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946500)"; flow:established,from_client; content:"GET"; http_method; content:"/tadashi.arm4"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"13.140.176.180"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946500/; classtype:trojan-activity;sid:84809600; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946501)"; flow:established,from_client; content:"GET"; http_method; content:"/bot.arm"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"217.60.241.5"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946501/; classtype:trojan-activity;sid:84809601; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946502)"; flow:established,from_client; content:"GET"; http_method; content:"/tadashi.mpsl"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"13.140.176.180"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946502/; classtype:trojan-activity;sid:84809602; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946503)"; flow:established,from_client; content:"GET"; http_method; content:"/boat_agent_armv7l"; http_uri; depth:18; isdataat:!1,relative; nocase; content:"46.247.108.103"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946503/; classtype:trojan-activity;sid:84809603; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946465)"; flow:established,from_client; content:"GET"; http_method; content:"/tadashi.arm6"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"13.140.176.180"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946465/; classtype:trojan-activity;sid:84809565; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946466)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_mips"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"170.64.142.108"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946466/; classtype:trojan-activity;sid:84809566; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946467)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_x86_64"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"170.64.142.108"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946467/; classtype:trojan-activity;sid:84809567; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946464)"; flow:established,from_client; content:"GET"; http_method; content:"/frpc_mips"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"108.137.82.100"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946464/; classtype:trojan-activity;sid:84809564; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946463)"; flow:established,from_client; content:"GET"; http_method; content:"/kkvettgaaasecnnaaaa.arm"; http_uri; depth:24; isdataat:!1,relative; nocase; content:"176.65.139.72"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946463/; classtype:trojan-activity;sid:84809563; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946462)"; flow:established,from_client; content:"GET"; http_method; content:"/kkvettgaaasecnnaaaa.mips"; http_uri; depth:25; isdataat:!1,relative; nocase; content:"176.65.139.72"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946462/; classtype:trojan-activity;sid:84809562; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946461)"; flow:established,from_client; content:"GET"; http_method; content:"/klogd-x64-musl"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946461/; classtype:trojan-activity;sid:84809561; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946459)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.ppc"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"66.29.151.122"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946459/; classtype:trojan-activity;sid:84809559; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946460)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.arm7"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"66.29.151.122"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946460/; classtype:trojan-activity;sid:84809560; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946457)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.mips"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"66.29.151.122"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946457/; classtype:trojan-activity;sid:84809557; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946458)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.arm5"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"66.29.151.122"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946458/; classtype:trojan-activity;sid:84809558; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946454)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.sh4"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"66.29.151.122"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946454/; classtype:trojan-activity;sid:84809554; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946455)"; flow:established,from_client; content:"GET"; http_method; content:"/klogd-ppc-603f"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946455/; classtype:trojan-activity;sid:84809555; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946456)"; flow:established,from_client; content:"GET"; http_method; content:"/frpc"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"108.137.82.100"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946456/; classtype:trojan-activity;sid:84809556; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946453)"; flow:established,from_client; content:"GET"; http_method; content:"/rathole-164-v5te"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946453/; classtype:trojan-activity;sid:84809553; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946451)"; flow:established,from_client; content:"GET"; http_method; content:"/kkvettgaaasecnnaaaa.i486"; http_uri; depth:25; isdataat:!1,relative; nocase; content:"176.65.139.72"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946451/; classtype:trojan-activity;sid:84809551; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946452)"; flow:established,from_client; content:"GET"; http_method; content:"/klogd-v048-x64"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946452/; classtype:trojan-activity;sid:84809552; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946450)"; flow:established,from_client; content:"GET"; http_method; content:"/klogd-freebsd"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946450/; classtype:trojan-activity;sid:84809550; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946449)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.arm6"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"66.29.151.122"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946449/; classtype:trojan-activity;sid:84809549; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946444)"; flow:established,from_client; content:"GET"; http_method; content:"/klogd-164-v5te"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946444/; classtype:trojan-activity;sid:84809544; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946445)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.mpsl"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"66.29.151.122"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946445/; classtype:trojan-activity;sid:84809545; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946446)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.arm"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"66.29.151.122"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946446/; classtype:trojan-activity;sid:84809546; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946447)"; flow:established,from_client; content:"GET"; http_method; content:"/klogd-ppc-final"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946447/; classtype:trojan-activity;sid:84809547; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946448)"; flow:established,from_client; content:"GET"; http_method; content:"/bx_arm5.p"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"23.254.195.48"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946448/; classtype:trojan-activity;sid:84809548; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946443)"; flow:established,from_client; content:"GET"; http_method; content:"/beacon_windows_amd64.exe"; http_uri; depth:25; isdataat:!1,relative; nocase; content:"23.254.195.48"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946443/; classtype:trojan-activity;sid:84809543; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946438)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.m68k"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"66.29.151.122"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946438/; classtype:trojan-activity;sid:84809538; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946439)"; flow:established,from_client; content:"GET"; http_method; content:"/klogd-ppc603"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946439/; classtype:trojan-activity;sid:84809539; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946440)"; flow:established,from_client; content:"GET"; http_method; content:"/t_arm5.so"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"23.254.195.48"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946440/; classtype:trojan-activity;sid:84809540; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946441)"; flow:established,from_client; content:"GET"; http_method; content:"/klogd-ppc"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946441/; classtype:trojan-activity;sid:84809541; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946442)"; flow:established,from_client; content:"GET"; http_method; content:"/bx_mipsle.p"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"23.254.195.48"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946442/; classtype:trojan-activity;sid:84809542; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946436)"; flow:established,from_client; content:"GET"; http_method; content:"/rathole-v048-amd64"; http_uri; depth:19; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946436/; classtype:trojan-activity;sid:84809536; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946437)"; flow:established,from_client; content:"GET"; http_method; content:"/ohshit.sh"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"172.245.106.144"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946437/; classtype:trojan-activity;sid:84809537; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946432)"; flow:established,from_client; content:"GET"; http_method; content:"/titanjr.arm7"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"40.160.135.244"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946432/; classtype:trojan-activity;sid:84809532; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946433)"; flow:established,from_client; content:"GET"; http_method; content:"/titanjr.mips"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"40.160.135.244"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946433/; classtype:trojan-activity;sid:84809533; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946434)"; flow:established,from_client; content:"GET"; http_method; content:"/titanjr.sh4"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"40.160.135.244"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946434/; classtype:trojan-activity;sid:84809534; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946435)"; flow:established,from_client; content:"GET"; http_method; content:"/titanjr.ppc"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"40.160.135.244"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946435/; classtype:trojan-activity;sid:84809535; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946425)"; flow:established,from_client; content:"GET"; http_method; content:"/mips"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"154.12.83.188"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946425/; classtype:trojan-activity;sid:84809525; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946426)"; flow:established,from_client; content:"GET"; http_method; content:"/beacon_linux_amd64"; http_uri; depth:19; isdataat:!1,relative; nocase; content:"23.254.195.48"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946426/; classtype:trojan-activity;sid:84809526; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946427)"; flow:established,from_client; content:"GET"; http_method; content:"/kkvettgaaasecnnaaaa.arm7"; http_uri; depth:25; isdataat:!1,relative; nocase; content:"176.65.139.72"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946427/; classtype:trojan-activity;sid:84809527; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946428)"; flow:established,from_client; content:"GET"; http_method; content:"/kkvettgaaasecnnaaaa.x86_64"; http_uri; depth:27; isdataat:!1,relative; nocase; content:"176.65.139.72"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946428/; classtype:trojan-activity;sid:84809528; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946429)"; flow:established,from_client; content:"GET"; http_method; content:"/riscv64"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"154.12.83.188"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946429/; classtype:trojan-activity;sid:84809529; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946430)"; flow:established,from_client; content:"GET"; http_method; content:"/kkvettgaaasecnnaaaa.mpsl"; http_uri; depth:25; isdataat:!1,relative; nocase; content:"176.65.139.72"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946430/; classtype:trojan-activity;sid:84809530; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946431)"; flow:established,from_client; content:"GET"; http_method; content:"/frpc_arm"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"108.137.82.100"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946431/; classtype:trojan-activity;sid:84809531; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946420)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.arc"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"66.29.151.122"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946420/; classtype:trojan-activity;sid:84809520; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946421)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.x86_debug"; http_uri; depth:18; isdataat:!1,relative; nocase; content:"66.29.151.122"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946421/; classtype:trojan-activity;sid:84809521; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946422)"; flow:established,from_client; content:"GET"; http_method; content:"/shitassbotttt.sh"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"66.29.151.122"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946422/; classtype:trojan-activity;sid:84809522; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946423)"; flow:established,from_client; content:"GET"; http_method; content:"/boatnet.x86"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"66.29.151.122"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946423/; classtype:trojan-activity;sid:84809523; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946424)"; flow:established,from_client; content:"GET"; http_method; content:"/t_armhf.so"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"23.254.195.48"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946424/; classtype:trojan-activity;sid:84809524; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946414)"; flow:established,from_client; content:"GET"; http_method; content:"/bx_mipsle"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"23.254.195.48"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946414/; classtype:trojan-activity;sid:84809514; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946415)"; flow:established,from_client; content:"GET"; http_method; content:"/titanjr.x86_64"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"40.160.135.244"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946415/; classtype:trojan-activity;sid:84809515; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946416)"; flow:established,from_client; content:"GET"; http_method; content:"/comm.sh"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"154.12.83.188"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946416/; classtype:trojan-activity;sid:84809516; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946417)"; flow:established,from_client; content:"GET"; http_method; content:"/patch.sh"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"154.12.83.188"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946417/; classtype:trojan-activity;sid:84809517; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946418)"; flow:established,from_client; content:"GET"; http_method; content:"/arm5"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"154.12.83.188"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946418/; classtype:trojan-activity;sid:84809518; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946419)"; flow:established,from_client; content:"GET"; http_method; content:"/x86_64"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"154.12.83.188"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946419/; classtype:trojan-activity;sid:84809519; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946408)"; flow:established,from_client; content:"GET"; http_method; content:"/bx_arm5"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"23.254.195.48"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946408/; classtype:trojan-activity;sid:84809508; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946409)"; flow:established,from_client; content:"GET"; http_method; content:"/titanjr.spc"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"40.160.135.244"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946409/; classtype:trojan-activity;sid:84809509; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946410)"; flow:established,from_client; content:"GET"; http_method; content:"/titanjr.mipsl"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"40.160.135.244"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946410/; classtype:trojan-activity;sid:84809510; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946411)"; flow:established,from_client; content:"GET"; http_method; content:"/t5c.so"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"23.254.195.48"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946411/; classtype:trojan-activity;sid:84809511; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946412)"; flow:established,from_client; content:"GET"; http_method; content:"/klogd-ppc-musl"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946412/; classtype:trojan-activity;sid:84809512; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946413)"; flow:established,from_client; content:"GET"; http_method; content:"/titanjr.arm6"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"40.160.135.244"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946413/; classtype:trojan-activity;sid:84809513; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946404)"; flow:established,from_client; content:"GET"; http_method; content:"/titanjr.x86_32"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"40.160.135.244"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946404/; classtype:trojan-activity;sid:84809504; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946405)"; flow:established,from_client; content:"GET"; http_method; content:"/beacon_rn"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"23.254.195.48"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946405/; classtype:trojan-activity;sid:84809505; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946406)"; flow:established,from_client; content:"GET"; http_method; content:"/bx_mips"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"23.254.195.48"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946406/; classtype:trojan-activity;sid:84809506; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946407)"; flow:established,from_client; content:"GET"; http_method; content:"/bx_arm"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"23.254.195.48"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946407/; classtype:trojan-activity;sid:84809507; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946401)"; flow:established,from_client; content:"GET"; http_method; content:"/arm6"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"154.12.83.188"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946401/; classtype:trojan-activity;sid:84809501; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946402)"; flow:established,from_client; content:"GET"; http_method; content:"/ga_armhfb.so"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"23.254.195.48"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946402/; classtype:trojan-activity;sid:84809502; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946403)"; flow:established,from_client; content:"GET"; http_method; content:"/ga_mipsel.so"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"23.254.195.48"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946403/; classtype:trojan-activity;sid:84809503; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946400)"; flow:established,from_client; content:"GET"; http_method; content:"/alte.sh"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"154.12.83.188"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946400/; classtype:trojan-activity;sid:84809500; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946399)"; flow:established,from_client; content:"GET"; http_method; content:"/rathole-v048-armv7"; http_uri; depth:19; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946399/; classtype:trojan-activity;sid:84809499; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946398)"; flow:established,from_client; content:"GET"; http_method; content:"/arm7"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"154.12.83.188"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946398/; classtype:trojan-activity;sid:84809498; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946396)"; flow:established,from_client; content:"GET"; http_method; content:"/x86"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"154.12.83.188"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946396/; classtype:trojan-activity;sid:84809496; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946397)"; flow:established,from_client; content:"GET"; http_method; content:"/rathole_amd64"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"154.83.85.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946397/; classtype:trojan-activity;sid:84809497; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946394)"; flow:established,from_client; content:"GET"; http_method; content:"/arm64"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"154.12.83.188"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946394/; classtype:trojan-activity;sid:84809494; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946395)"; flow:established,from_client; content:"GET"; http_method; content:"/mpsl"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"154.12.83.188"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946395/; classtype:trojan-activity;sid:84809495; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946379)"; flow:established,from_client; content:"GET"; http_method; content:"/ga_arm.so"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"23.254.195.48"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946379/; classtype:trojan-activity;sid:84809479; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946380)"; flow:established,from_client; content:"GET"; http_method; content:"/ga_mips.so"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"23.254.195.48"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946380/; classtype:trojan-activity;sid:84809480; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946381)"; flow:established,from_client; content:"GET"; http_method; content:"/titanjr.i486"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"40.160.135.244"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946381/; classtype:trojan-activity;sid:84809481; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946382)"; flow:established,from_client; content:"GET"; http_method; content:"/ga2_mips.so"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"23.254.195.48"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946382/; classtype:trojan-activity;sid:84809482; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946383)"; flow:established,from_client; content:"GET"; http_method; content:"/ga_armb.so"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"23.254.195.48"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946383/; classtype:trojan-activity;sid:84809483; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946384)"; flow:established,from_client; content:"GET"; http_method; content:"/titanjr.arc"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"40.160.135.244"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946384/; classtype:trojan-activity;sid:84809484; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946385)"; flow:established,from_client; content:"GET"; http_method; content:"/titanjr.arm5"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"40.160.135.244"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946385/; classtype:trojan-activity;sid:84809485; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946386)"; flow:established,from_client; content:"GET"; http_method; content:"/titanjr.ppc440"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"40.160.135.244"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946386/; classtype:trojan-activity;sid:84809486; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946387)"; flow:established,from_client; content:"GET"; http_method; content:"/titanjr.i686"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"40.160.135.244"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946387/; classtype:trojan-activity;sid:84809487; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946388)"; flow:established,from_client; content:"GET"; http_method; content:"/arm"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"154.12.83.188"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946388/; classtype:trojan-activity;sid:84809488; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946389)"; flow:established,from_client; content:"GET"; http_method; content:"/t5b.so"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"23.254.195.48"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946389/; classtype:trojan-activity;sid:84809489; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946390)"; flow:established,from_client; content:"GET"; http_method; content:"/all.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"40.160.135.244"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946390/; classtype:trojan-activity;sid:84809490; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946391)"; flow:established,from_client; content:"GET"; http_method; content:"/titanjr.m68k"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"40.160.135.244"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946391/; classtype:trojan-activity;sid:84809491; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946392)"; flow:established,from_client; content:"GET"; http_method; content:"/ga_armhf.so"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"23.254.195.48"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946392/; classtype:trojan-activity;sid:84809492; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946393)"; flow:established,from_client; content:"GET"; http_method; content:"/titanjr.arm"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"40.160.135.244"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946393/; classtype:trojan-activity;sid:84809493; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946378)"; flow:established,from_client; content:"GET"; http_method; content:"/ga2_mipsel.so"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"23.254.195.48"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946378/; classtype:trojan-activity;sid:84809478; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946376)"; flow:established,from_client; content:"GET"; http_method; content:"/emp.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"154.12.83.188"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946376/; classtype:trojan-activity;sid:84809476; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946377)"; flow:established,from_client; content:"GET"; http_method; content:"/wrd.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"154.12.83.188"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946377/; classtype:trojan-activity;sid:84809477; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946375)"; flow:established,from_client; content:"GET"; http_method; content:"/bot.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"38.55.99.215"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946375/; classtype:trojan-activity;sid:84809475; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946374)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.225.228.19"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946374/; classtype:trojan-activity;sid:84809474; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946373)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"118.253.80.15"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946373/; classtype:trojan-activity;sid:84809473; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946372)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.49.193.168"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946372/; classtype:trojan-activity;sid:84809472; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946370)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.184.69.68"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946370/; classtype:trojan-activity;sid:84809470; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946371)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.40.86.102"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946371/; classtype:trojan-activity;sid:84809471; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946366)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.236.36.200"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946366/; classtype:trojan-activity;sid:84809466; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946367)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.224.199.236"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946367/; classtype:trojan-activity;sid:84809467; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946368)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.43.34.132"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946368/; classtype:trojan-activity;sid:84809468; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946369)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.28.189.218"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946369/; classtype:trojan-activity;sid:84809469; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946365)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"221.14.84.60"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946365/; classtype:trojan-activity;sid:84809465; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946364)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.47.113.29"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946364/; classtype:trojan-activity;sid:84809464; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946363)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"105.184.69.68"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946363/; classtype:trojan-activity;sid:84809463; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946361)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"37.48.146.38"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946361/; classtype:trojan-activity;sid:84809461; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946362)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"118.253.80.15"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946362/; classtype:trojan-activity;sid:84809462; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946360)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"103.125.174.116"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946360/; classtype:trojan-activity;sid:84809460; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946359)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"203.196.41.11"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946359/; classtype:trojan-activity;sid:84809459; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946358)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"120.28.215.36"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946358/; classtype:trojan-activity;sid:84809458; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946357)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.127.34.173"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946357/; classtype:trojan-activity;sid:84809457; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946354)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"113.236.36.200"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946354/; classtype:trojan-activity;sid:84809454; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946355)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.55.32.63"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946355/; classtype:trojan-activity;sid:84809455; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946356)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"59.96.136.187"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946356/; classtype:trojan-activity;sid:84809456; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946352)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"78.38.120.12"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946352/; classtype:trojan-activity;sid:84809452; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946353)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"223.10.5.93"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946353/; classtype:trojan-activity;sid:84809453; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946351)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"37.48.146.38"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946351/; classtype:trojan-activity;sid:84809451; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946349)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.44.145.224"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946349/; classtype:trojan-activity;sid:84809449; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946350)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"178.205.204.128"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946350/; classtype:trojan-activity;sid:84809450; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946346)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.206.110.121"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946346/; classtype:trojan-activity;sid:84809446; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946347)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.44.145.224"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946347/; classtype:trojan-activity;sid:84809447; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946348)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.157.52.153"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946348/; classtype:trojan-activity;sid:84809448; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946344)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1553507397694267543/1555954495924473926/goobaclient-crackedbydexter.jar|3f|backend=b2|7c|26|7c|ex=6ac8fe8c|7c|26|7c|is=6ac7ad0c|7c|26|7c|hm=30490a5f62bada0ce835ed0448d0c50f22e598bf29d409d1392a080ca82d3798|7c|26|7c|"; http_uri; depth:227; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946344/; classtype:trojan-activity;sid:84809444; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946345)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1556991568970256465/1556992019174395924/corzcracked.jar|3f|backend=b2|7c|26|7c|ex=6ac8d050|7c|26|7c|is=6ac77ed0|7c|26|7c|hm=3364e8b8209bda9ecad64fa88559296c84ab8d8b0d598c13387100c0489f4e88|7c|26|7c|"; http_uri; depth:211; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946345/; classtype:trojan-activity;sid:84809445; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946343)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1552081896521990165/1555955699362697216/kryptonclient-crackedbydexter.jar|3f|backend=b2|7c|26|7c|ex=6ac8ffaa|7c|26|7c|is=6ac7ae2a|7c|26|7c|hm=32b960a4bf540c7fd00431a7ec304ddd1479175f7be2a9b58e6863530f0fb8ba|7c|26|7c|"; http_uri; depth:229; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946343/; classtype:trojan-activity;sid:84809443; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946339)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1554893100869230603/1555954067048763453/zenns-addon-v4-crackedbydexter.jar|3f|backend=b2|7c|26|7c|ex=6ac8fe25|7c|26|7c|is=6ac7aca5|7c|26|7c|hm=d4e0c6b375fa4a495ca11fbd00bca4c21ac78349d84321e29c5a878b1eca76b0|7c|26|7c|"; http_uri; depth:230; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946339/; classtype:trojan-activity;sid:84809439; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946340)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1548811185716068484/1555955351206105219/zenns-addon-v4-crackedbydexter.jar|3f|backend=b2|7c|26|7c|ex=6ac8ff57|7c|26|7c|is=6ac7add7|7c|26|7c|hm=30ee7fe8b95274195e39d69d6e7cb98ba63a847928ffd36d4a10117f56ece837|7c|26|7c|"; http_uri; depth:230; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946340/; classtype:trojan-activity;sid:84809440; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946341)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1549548390751272981/1555954988667113542/opsec-1.21.11-crackedbydexter.jar|3f|backend=b2|7c|26|7c|ex=6ac8ff01|7c|26|7c|is=6ac7ad81|7c|26|7c|hm=495621443a4b2ffeaee152ecdd0e6db99a74077c550043c0f6653cda754039a9|7c|26|7c|"; http_uri; depth:229; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946341/; classtype:trojan-activity;sid:84809441; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946342)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1552082475117715466/1555956021954875493/gamblerig-bydexter.jar|3f|backend=b2|7c|26|7c|ex=6ac8fff7|7c|26|7c|is=6ac7ae77|7c|26|7c|hm=60a51d0b7812f7feb59b405104fc25e80f9895b97a3c48a55c9aee5a442ae792|7c|26|7c|"; http_uri; depth:218; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946342/; classtype:trojan-activity;sid:84809442; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946337)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1553507058844696606/1555956170961854504/dupemodv2-bydexter.jar|3f|backend=b2|7c|26|7c|ex=6ac9001b|7c|26|7c|is=6ac7ae9b|7c|26|7c|hm=3fa2bf9e9d1e2e1a2f0922f42e35eae758a67f45aaa2a85fea120ceecf68609a|7c|26|7c|"; http_uri; depth:218; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946337/; classtype:trojan-activity;sid:84809437; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946338)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1548811292536610887/1555955159287201872/67client-crackedbydexter.jar|3f|backend=b2|7c|26|7c|ex=6ac8ff2a|7c|26|7c|is=6ac7adaa|7c|26|7c|hm=9a556ee8f2a04bb6bf7b6e0d48dd9f70c6c11e1956a9c12895ffd3d2051a835f|7c|26|7c|"; http_uri; depth:224; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946338/; classtype:trojan-activity;sid:84809438; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946336)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1552081896521990165/1555955699362697216/kryptonclient-crackedbydexter.jar|3f|backend=b2|7c|26|7c|ex=6ac8ffaa|7c|26|7c|is=6ac7ae2a|7c|26|7c|hm=32b960a4bf540c7fd00431a7ec304ddd1479175f7be2a9b58e6863530f0fb8ba|7c|26|7c|https://cdn.discordapp.com/attachments/1552380411219288175/1555954669157621871/ikea_client-crackedbydexter.jar|3f|backend=b2|7c|26|7c|ex=6ac8feb5|7c|26|7c|is=6ac7ad35|7c|26|7c|hm=bfdcbbaa3aee72faa061c2ccfa23c4b5d3f4c6640b5e5dd8c3e6d1f0c029d7b6|7c|26|7c|"; http_uri; depth:482; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946336/; classtype:trojan-activity;sid:84809436; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946333)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1550498309259657247/1555954844391575632/mvaddon-crackedbydexter.jar|3f|backend=b2|7c|26|7c|ex=6ac8fedf|7c|26|7c|is=6ac7ad5f|7c|26|7c|hm=040eabcf0360361a39cf6cea01fba5a346c592fcc725489f3112f3ca3f8b284e|7c|26|7c|"; http_uri; depth:223; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946333/; classtype:trojan-activity;sid:84809433; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946334)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1553507130621825175/1555956345495228558/dupemodv1-bydexter.jar|3f|backend=b2|7c|26|7c|ex=6ac90045|7c|26|7c|is=6ac7aec5|7c|26|7c|hm=d109270946e3f8e1f5c6de54f3c7f5bfed7c79c00c564f28ad2919761c2857eb|7c|26|7c|"; http_uri; depth:218; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946334/; classtype:trojan-activity;sid:84809434; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946335)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1552380411219288175/1555954669157621871/ikea_client-crackedbydexter.jar|3f|backend=b2|7c|26|7c|ex=6ac8feb5|7c|26|7c|is=6ac7ad35|7c|26|7c|hm=bfdcbbaa3aee72faa061c2ccfa23c4b5d3f4c6640b5e5dd8c3e6d1f0c029d7b6|7c|26|7c|"; http_uri; depth:227; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946335/; classtype:trojan-activity;sid:84809435; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946332)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.189.68.239"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946332/; classtype:trojan-activity;sid:84809432; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946331)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.85.162.250"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946331/; classtype:trojan-activity;sid:84809431; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946330)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.24.126.151"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946330/; classtype:trojan-activity;sid:84809430; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946329)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"117.223.141.168"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946329/; classtype:trojan-activity;sid:84809429; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946328)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"223.10.5.93"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946328/; classtype:trojan-activity;sid:84809428; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946327)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"36.89.252.178"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946327/; classtype:trojan-activity;sid:84809427; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946326)"; flow:established,from_client; content:"GET"; http_method; content:"/downloads/enjoyer-addon-1.21.11.jar"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"donutclientsmods.xyz"; http_host; depth:20; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946326/; classtype:trojan-activity;sid:84809426; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946325)"; flow:established,from_client; content:"GET"; http_method; content:"/downloads/wimpy-client-1.21.11.jar"; http_uri; depth:35; isdataat:!1,relative; nocase; content:"donutclientsmods.xyz"; http_host; depth:20; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946325/; classtype:trojan-activity;sid:84809425; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946324)"; flow:established,from_client; content:"GET"; http_method; content:"/downloads/corz-client-1.21.11.jar"; http_uri; depth:34; isdataat:!1,relative; nocase; content:"donutclientsmods.xyz"; http_host; depth:20; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946324/; classtype:trojan-activity;sid:84809424; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946323)"; flow:established,from_client; content:"GET"; http_method; content:"/downloads/shared-client-macro-tool.exe"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"donutclientsmods.xyz"; http_host; depth:20; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946323/; classtype:trojan-activity;sid:84809423; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946322)"; flow:established,from_client; content:"GET"; http_method; content:"/downloads/krypton-avengers-addon-1.21.11.jar"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"donutclientsmods.xyz"; http_host; depth:20; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946322/; classtype:trojan-activity;sid:84809422; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946321)"; flow:established,from_client; content:"GET"; http_method; content:"/arm7"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"36.50.134.86"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946321/; classtype:trojan-activity;sid:84809421; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946320)"; flow:established,from_client; content:"GET"; http_method; content:"/debug.dbg"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"36.50.134.86"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946320/; classtype:trojan-activity;sid:84809420; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946318)"; flow:established,from_client; content:"GET"; http_method; content:"/downloads/babo-debug-addon-1.21.11.jar"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"donutclientsmods.xyz"; http_host; depth:20; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946318/; classtype:trojan-activity;sid:84809418; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946319)"; flow:established,from_client; content:"GET"; http_method; content:"/downloads/fake-skelly-and-elytra-mod-1.21.11.jar"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"donutclientsmods.xyz"; http_host; depth:20; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946319/; classtype:trojan-activity;sid:84809419; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946316)"; flow:established,from_client; content:"GET"; http_method; content:"/downloads/krypton-client-1.21.11.jar"; http_uri; depth:37; isdataat:!1,relative; nocase; content:"donutclientsmods.xyz"; http_host; depth:20; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946316/; classtype:trojan-activity;sid:84809416; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946317)"; flow:established,from_client; content:"GET"; http_method; content:"/downloads/larp-addon-1.21.11.jar"; http_uri; depth:33; isdataat:!1,relative; nocase; content:"donutclientsmods.xyz"; http_host; depth:20; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946317/; classtype:trojan-activity;sid:84809417; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946315)"; flow:established,from_client; content:"GET"; http_method; content:"/5f55f63f-4335-4413-a67f-64c697161d58"; http_uri; depth:37; isdataat:!1,relative; nocase; content:"donutclientsmods.xyz"; http_host; depth:20; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946315/; classtype:trojan-activity;sid:84809415; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946313)"; flow:established,from_client; content:"GET"; http_method; content:"/sh4"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"36.50.134.86"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946313/; classtype:trojan-activity;sid:84809413; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946314)"; flow:established,from_client; content:"GET"; http_method; content:"/downloads/bassa-addon-1.21.11.jar"; http_uri; depth:34; isdataat:!1,relative; nocase; content:"donutclientsmods.xyz"; http_host; depth:20; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946314/; classtype:trojan-activity;sid:84809414; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946312)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.239.103.119"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946312/; classtype:trojan-activity;sid:84809412; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946311)"; flow:established,from_client; content:"GET"; http_method; content:"/files-129312398/files/file_9771925585841dc0.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"91.92.242.236"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946311/; classtype:trojan-activity;sid:84809411; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946310)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"117.223.141.168"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946310/; classtype:trojan-activity;sid:84809410; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946309)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.14.84.60"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946309/; classtype:trojan-activity;sid:84809409; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946308)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.208.164.251"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946308/; classtype:trojan-activity;sid:84809408; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946307)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.86.117.7"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946307/; classtype:trojan-activity;sid:84809407; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946306)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"113.239.103.119"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946306/; classtype:trojan-activity;sid:84809406; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946305)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.233.198.83"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946305/; classtype:trojan-activity;sid:84809405; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946304)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.180.132.133"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946304/; classtype:trojan-activity;sid:84809404; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946303)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.214.58.83"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946303/; classtype:trojan-activity;sid:84809403; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946301)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.121.146.105"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946301/; classtype:trojan-activity;sid:84809401; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946302)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.5.65.221"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946302/; classtype:trojan-activity;sid:84809402; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946299)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.121.146.105"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946299/; classtype:trojan-activity;sid:84809399; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946300)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.208.164.251"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946300/; classtype:trojan-activity;sid:84809400; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946297)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.49.201.133"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946297/; classtype:trojan-activity;sid:84809397; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946298)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.57.62.230"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946298/; classtype:trojan-activity;sid:84809398; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946296)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"2.187.251.80"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946296/; classtype:trojan-activity;sid:84809396; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946295)"; flow:established,from_client; content:"GET"; http_method; content:"/file/w1aqh6dqcft06ip/file"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"www.mediafire.com"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946295/; classtype:trojan-activity;sid:84809395; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946294)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"87.5.64.246"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946294/; classtype:trojan-activity;sid:84809394; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946293)"; flow:established,from_client; content:"GET"; http_method; content:"/files-129312398/files/file_9fc392f279df529c.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"91.92.242.236"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946293/; classtype:trojan-activity;sid:84809393; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946292)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"210.208.110.147"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946292/; classtype:trojan-activity;sid:84809392; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946290)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.52.197.166"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946290/; classtype:trojan-activity;sid:84809390; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946291)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.137.72.136"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946291/; classtype:trojan-activity;sid:84809391; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946289)"; flow:established,from_client; content:"GET"; http_method; content:"/svlromhuu0fgbet1vdgw6vzmexzvuu304wflhblzlpxwoklp17drhd-b4tneswce4dogsseiz3hw-ykzxqh44zzcjx3qn40p-khbao574f5pdkpcslkrhm4rra6eznkorrhcgpb1jxfhqy-pqlyo-xwcfmxiqyk8hqpfklc/b9htoqy9l9sgfdx/bfeegnota1q9tl2.95789.40552copia.zip"; http_uri; depth:221; isdataat:!1,relative; nocase; content:"download1472.mediafire.com"; http_host; depth:26; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946289/; classtype:trojan-activity;sid:84809389; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946288)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.22.8.194"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946288/; classtype:trojan-activity;sid:84809388; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946287)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"103.70.87.32"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946287/; classtype:trojan-activity;sid:84809387; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946284)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.10.234.172"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946284/; classtype:trojan-activity;sid:84809384; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946285)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.50.168.193"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946285/; classtype:trojan-activity;sid:84809385; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946286)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.215.55.107"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946286/; classtype:trojan-activity;sid:84809386; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946283)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"58.98.230.152"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946283/; classtype:trojan-activity;sid:84809383; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946282)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.137.72.136"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946282/; classtype:trojan-activity;sid:84809382; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946280)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.190.105.170"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946280/; classtype:trojan-activity;sid:84809380; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946281)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.138.78.101"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946281/; classtype:trojan-activity;sid:84809381; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946279)"; flow:established,from_client; content:"GET"; http_method; content:"/files-129312398/files/file_127db278893126d7.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"91.92.242.236"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946279/; classtype:trojan-activity;sid:84809379; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946278)"; flow:established,from_client; content:"GET"; http_method; content:"/files-129312398/files/file_d7bf7d92c202104a.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"91.92.242.236"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946278/; classtype:trojan-activity;sid:84809378; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946277)"; flow:established,from_client; content:"GET"; http_method; content:"/ycl"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"91.240.118.10"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946277/; classtype:trojan-activity;sid:84809377; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946276)"; flow:established,from_client; content:"GET"; http_method; content:"/service"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"91.240.118.10"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946276/; classtype:trojan-activity;sid:84809376; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946274)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.50.168.193"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946274/; classtype:trojan-activity;sid:84809374; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946275)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.162.15.66"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946275/; classtype:trojan-activity;sid:84809375; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946273)"; flow:established,from_client; content:"GET"; http_method; content:"/update"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"91.240.118.10"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946273/; classtype:trojan-activity;sid:84809373; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946272)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"58.98.230.152"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946272/; classtype:trojan-activity;sid:84809372; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946271)"; flow:established,from_client; content:"GET"; http_method; content:"/files/8351821253/ocnvpm7.exe"; http_uri; depth:29; isdataat:!1,relative; nocase; content:"62.60.226.140"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946271/; classtype:trojan-activity;sid:84809371; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946270)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.11.8.211"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946270/; classtype:trojan-activity;sid:84809370; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946269)"; flow:established,from_client; content:"GET"; http_method; content:"/"; http_uri; depth:1; isdataat:!1,relative; nocase; content:"217.60.195.187"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946269/; classtype:trojan-activity;sid:84809369; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946268)"; flow:established,from_client; content:"GET"; http_method; content:"/cinstall.ps1"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"c23c1b-fa77-48e0-8272-692b579a574c.gorsefield.cc"; http_host; depth:48; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946268/; classtype:trojan-activity;sid:84809368; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946267)"; flow:established,from_client; content:"GET"; http_method; content:"/"; http_uri; depth:1; isdataat:!1,relative; nocase; content:"sayosay.cc"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946267/; classtype:trojan-activity;sid:84809367; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946266)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arc"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"104.64.0.199"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946266/; classtype:trojan-activity;sid:84809366; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946263)"; flow:established,from_client; content:"GET"; http_method; content:"/ljezs/services.apk"; http_uri; depth:19; isdataat:!1,relative; nocase; content:"217.60.195.187"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946263/; classtype:trojan-activity;sid:84809363; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946264)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.x86"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"104.64.0.199"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946264/; classtype:trojan-activity;sid:84809364; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946265)"; flow:established,from_client; content:"GET"; http_method; content:"/services.apk"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"108.165.95.17"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946265/; classtype:trojan-activity;sid:84809365; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946262)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.47.72.15"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946262/; classtype:trojan-activity;sid:84809362; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946260)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.154.105.47"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946260/; classtype:trojan-activity;sid:84809360; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946261)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.10.234.172"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946261/; classtype:trojan-activity;sid:84809361; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946259)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.13.84.124"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946259/; classtype:trojan-activity;sid:84809359; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946258)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"2.187.248.206"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946258/; classtype:trojan-activity;sid:84809358; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946257)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.230.34.172"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946257/; classtype:trojan-activity;sid:84809357; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946256)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.202.215.185"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946256/; classtype:trojan-activity;sid:84809356; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946255)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"36.70.101.43"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946255/; classtype:trojan-activity;sid:84809355; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946254)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"119.154.105.47"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946254/; classtype:trojan-activity;sid:84809354; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946251)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"61.136.85.234"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946251/; classtype:trojan-activity;sid:84809351; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946252)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.189.176.51"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946252/; classtype:trojan-activity;sid:84809352; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946253)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.184.182.169"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946253/; classtype:trojan-activity;sid:84809353; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946250)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.142.202.93"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946250/; classtype:trojan-activity;sid:84809350; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946248)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"103.172.186.194"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946248/; classtype:trojan-activity;sid:84809348; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946249)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.11.8.211"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946249/; classtype:trojan-activity;sid:84809349; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946247)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.227.202.230"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946247/; classtype:trojan-activity;sid:84809347; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946245)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.142.202.93"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946245/; classtype:trojan-activity;sid:84809345; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946246)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.196.0.230"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946246/; classtype:trojan-activity;sid:84809346; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946242)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.45.10.115"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946242/; classtype:trojan-activity;sid:84809342; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946243)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.11.7.18"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946243/; classtype:trojan-activity;sid:84809343; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946244)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"119.116.34.218"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946244/; classtype:trojan-activity;sid:84809344; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946241)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"112.246.228.19"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946241/; classtype:trojan-activity;sid:84809341; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946238)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.227.202.230"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946238/; classtype:trojan-activity;sid:84809338; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946239)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.189.157.12"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946239/; classtype:trojan-activity;sid:84809339; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946240)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.55.4.215"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946240/; classtype:trojan-activity;sid:84809340; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946237)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.53.117.5"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946237/; classtype:trojan-activity;sid:84809337; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946236)"; flow:established,from_client; content:"GET"; http_method; content:"/bussiness12/server/raw/main/newfloder.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"bitbucket.org"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946236/; classtype:trojan-activity;sid:84809336; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946235)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.137.74.230"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946235/; classtype:trojan-activity;sid:84809335; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946231)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.238.171.110"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946231/; classtype:trojan-activity;sid:84809331; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946232)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.173.2.43"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946232/; classtype:trojan-activity;sid:84809332; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946233)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"37.13.43.153"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946233/; classtype:trojan-activity;sid:84809333; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946234)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.141.112.238"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946234/; classtype:trojan-activity;sid:84809334; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946230)"; flow:established,from_client; content:"GET"; http_method; content:"/arm6"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"36.50.134.86"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946230/; classtype:trojan-activity;sid:84809330; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946227)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/pmips"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"94.154.43.203"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946227/; classtype:trojan-activity;sid:84809327; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946228)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/pm68k"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"94.154.43.203"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946228/; classtype:trojan-activity;sid:84809328; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946229)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.mips"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"204.194.50.3"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946229/; classtype:trojan-activity;sid:84809329; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946218)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.sh4"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"204.194.50.3"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946218/; classtype:trojan-activity;sid:84809318; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946219)"; flow:established,from_client; content:"GET"; http_method; content:"/m68k"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"36.50.134.86"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946219/; classtype:trojan-activity;sid:84809319; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946220)"; flow:established,from_client; content:"GET"; http_method; content:"/x86"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"36.50.134.86"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946220/; classtype:trojan-activity;sid:84809320; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946221)"; flow:established,from_client; content:"GET"; http_method; content:"/mpsl"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"36.50.134.86"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946221/; classtype:trojan-activity;sid:84809321; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946222)"; flow:established,from_client; content:"GET"; http_method; content:"/arm"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"36.50.134.86"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946222/; classtype:trojan-activity;sid:84809322; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946223)"; flow:established,from_client; content:"GET"; http_method; content:"/ppc"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"36.50.134.86"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946223/; classtype:trojan-activity;sid:84809323; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946224)"; flow:established,from_client; content:"GET"; http_method; content:"/arm5"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"36.50.134.86"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946224/; classtype:trojan-activity;sid:84809324; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946225)"; flow:established,from_client; content:"GET"; http_method; content:"/mips"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"36.50.134.86"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946225/; classtype:trojan-activity;sid:84809325; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946226)"; flow:established,from_client; content:"GET"; http_method; content:"/x86_64"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"36.50.134.86"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946226/; classtype:trojan-activity;sid:84809326; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946208)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/parm6"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"94.154.43.203"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946208/; classtype:trojan-activity;sid:84809308; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946209)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/arm6"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"94.154.43.203"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946209/; classtype:trojan-activity;sid:84809309; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946210)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.arm"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"204.194.50.3"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946210/; classtype:trojan-activity;sid:84809310; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946211)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.ppc"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"204.194.50.3"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946211/; classtype:trojan-activity;sid:84809311; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946212)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.x86"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"204.194.50.3"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946212/; classtype:trojan-activity;sid:84809312; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946213)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.mpsl"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"204.194.50.3"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946213/; classtype:trojan-activity;sid:84809313; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946214)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.m68k"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"204.194.50.3"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946214/; classtype:trojan-activity;sid:84809314; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946215)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.arm5"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"204.194.50.3"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946215/; classtype:trojan-activity;sid:84809315; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946216)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.spc"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"204.194.50.3"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946216/; classtype:trojan-activity;sid:84809316; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946217)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.arm6"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"204.194.50.3"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946217/; classtype:trojan-activity;sid:84809317; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946199)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/arm5"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"94.154.43.203"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946199/; classtype:trojan-activity;sid:84809299; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946200)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/parm5"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"94.154.43.203"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946200/; classtype:trojan-activity;sid:84809300; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946201)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/parm"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"94.154.43.203"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946201/; classtype:trojan-activity;sid:84809301; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946202)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/parm7"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"94.154.43.203"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946202/; classtype:trojan-activity;sid:84809302; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946203)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/pmpsl"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"94.154.43.203"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946203/; classtype:trojan-activity;sid:84809303; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946204)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/mips"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"94.154.43.203"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946204/; classtype:trojan-activity;sid:84809304; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946205)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/arm"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"94.154.43.203"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946205/; classtype:trojan-activity;sid:84809305; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946206)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/psh4"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"94.154.43.203"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946206/; classtype:trojan-activity;sid:84809306; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946207)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/arm7"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"94.154.43.203"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946207/; classtype:trojan-activity;sid:84809307; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946197)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.50.4.17"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946197/; classtype:trojan-activity;sid:84809297; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946198)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.121.216.203"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946198/; classtype:trojan-activity;sid:84809298; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946196)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"116.140.187.113"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946196/; classtype:trojan-activity;sid:84809296; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946195)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.173.212.106"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946195/; classtype:trojan-activity;sid:84809295; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946194)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.50.4.17"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946194/; classtype:trojan-activity;sid:84809294; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946193)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.101.213.193"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946193/; classtype:trojan-activity;sid:84809293; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946192)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.62.146.93"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946192/; classtype:trojan-activity;sid:84809292; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946189)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.127.34.173"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946189/; classtype:trojan-activity;sid:84809289; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946190)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.54.182.226"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946190/; classtype:trojan-activity;sid:84809290; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946191)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.19.83.106"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946191/; classtype:trojan-activity;sid:84809291; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946187)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.215.52.52"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946187/; classtype:trojan-activity;sid:84809287; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946188)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.23.232.227"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946188/; classtype:trojan-activity;sid:84809288; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946186)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"202.110.9.54"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946186/; classtype:trojan-activity;sid:84809286; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946184)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.231.236.226"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946184/; classtype:trojan-activity;sid:84809284; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946185)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.44.59.247"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946185/; classtype:trojan-activity;sid:84809285; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946182)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.215.52.52"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946182/; classtype:trojan-activity;sid:84809282; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946183)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.232.228.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946183/; classtype:trojan-activity;sid:84809283; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946181)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.124.176.103"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946181/; classtype:trojan-activity;sid:84809281; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946180)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.23.232.227"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946180/; classtype:trojan-activity;sid:84809280; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946179)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.124.176.103"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946179/; classtype:trojan-activity;sid:84809279; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946178)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.156.34.50"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946178/; classtype:trojan-activity;sid:84809278; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946177)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"200.115.102.246"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946177/; classtype:trojan-activity;sid:84809277; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946176)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.30.44.142"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946176/; classtype:trojan-activity;sid:84809276; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946175)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.61.11.118"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946175/; classtype:trojan-activity;sid:84809275; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946174)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.117.71.204"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946174/; classtype:trojan-activity;sid:84809274; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946173)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.44.59.247"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946173/; classtype:trojan-activity;sid:84809273; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946168)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.231.236.226"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946168/; classtype:trojan-activity;sid:84809268; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946169)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.61.11.118"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946169/; classtype:trojan-activity;sid:84809269; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946170)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.214.58.83"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946170/; classtype:trojan-activity;sid:84809270; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946171)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"219.156.34.50"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946171/; classtype:trojan-activity;sid:84809271; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946172)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.47.113.53"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946172/; classtype:trojan-activity;sid:84809272; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946165)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.232.228.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946165/; classtype:trojan-activity;sid:84809265; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946166)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.178.216.181"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946166/; classtype:trojan-activity;sid:84809266; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946167)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.138.117.220"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946167/; classtype:trojan-activity;sid:84809267; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946164)"; flow:established,from_client; content:"GET"; http_method; content:"/img/img_234853.png"; http_uri; depth:19; isdataat:!1,relative; nocase; content:"ascomsecurity.com.au"; http_host; depth:20; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946164/; classtype:trojan-activity;sid:84809264; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946163)"; flow:established,from_client; content:"GET"; http_method; content:"/hta/oo.txt"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"www.epibenie.dz"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946163/; classtype:trojan-activity;sid:84809263; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946162)"; flow:established,from_client; content:"GET"; http_method; content:"/vuztq"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"rough-truth-e072.publicftpresend.workers.dev"; http_host; depth:44; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946162/; classtype:trojan-activity;sid:84809262; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946161)"; flow:established,from_client; content:"GET"; http_method; content:"/wtyt1562/secured_stub.ps1"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"195.177.94.235"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946161/; classtype:trojan-activity;sid:84809261; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946160)"; flow:established,from_client; content:"GET"; http_method; content:"/nnzez/secured_stub.ps1"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"flocmaterials.shop"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946160/; classtype:trojan-activity;sid:84809260; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946159)"; flow:established,from_client; content:"GET"; http_method; content:"/masaabikz/secured_stub.ps1"; http_uri; depth:27; isdataat:!1,relative; nocase; content:"aksiyononline.best"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946159/; classtype:trojan-activity;sid:84809259; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946158)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"220.201.98.115"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946158/; classtype:trojan-activity;sid:84809258; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946157)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.230.46.226"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946157/; classtype:trojan-activity;sid:84809257; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946155)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.237.52.190"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946155/; classtype:trojan-activity;sid:84809255; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946156)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.230.46.226"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946156/; classtype:trojan-activity;sid:84809256; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946154)"; flow:established,from_client; content:"GET"; http_method; content:"/bin/connectwisecontrol.clientsetup.msi|3f|h=13.37.72.210|7c|26|7c|p=8041|7c|26|7c|k=bgiaaackaabsu0exaagaaaeaaqafj7zuwxp5bwvihjtbf5tpj7sz3vzwfq8m7qzruurh8ddt5zth16exqctqgtdc3%2f6cderipg90lvrjzx4%2fuh8mhic8wt2uhwg0ttg%2bw8jnkihaix5%2bak5v%2fblg7zv8vvpvipen%2bijwkto%2b%2ft2rajjkmneizxvhbdkkmcgloguooehqtd2zzee%2b%2bybikt2%2btii8jvjd9udccudkobtniilma4ld%2f18hsk9ixwik3cby%2bibrxpop6s%2ba2rbet3wdvt0np%2bdqruokf2a8iowrzdsyay9rezq6vqse0ufvmlhinz31aqkpmmomth4o%2bmavaj8l%2b4%2b2cando%2bb6%2bfylxuza|7c|26|7c|e=access|7c|26|7c|y=guest|7c|26|7c|t=|7c|26|7c|c=|7c|26|7c|c=|7c|26|7c|c=|7c|26|7c|c=|7c|26|7c|c=|7c|26|7c|c=|7c|26|7c|c=|7c|26|7c|c="; http_uri; depth:636; isdataat:!1,relative; nocase; content:"13.37.72.210"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946154/; classtype:trojan-activity;sid:84809254; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946153)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.30.44.142"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946153/; classtype:trojan-activity;sid:84809253; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946152)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"203.177.28.149"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946152/; classtype:trojan-activity;sid:84809252; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946151)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"221.203.183.158"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946151/; classtype:trojan-activity;sid:84809251; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946150)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.44.147.208"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946150/; classtype:trojan-activity;sid:84809250; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946148)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.a"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"120.28.161.60"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946148/; classtype:trojan-activity;sid:84809248; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946149)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.134.173.157"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946149/; classtype:trojan-activity;sid:84809249; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946146)"; flow:established,from_client; content:"GET"; http_method; content:"/api/settings/linux"; http_uri; depth:19; isdataat:!1,relative; nocase; content:"trickgs-demo.vercel.app"; http_host; depth:23; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946146/; classtype:trojan-activity;sid:84809246; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946147)"; flow:established,from_client; content:"GET"; http_method; content:"/api/settings/env"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"trickgs-demo.vercel.app"; http_host; depth:23; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946147/; classtype:trojan-activity;sid:84809247; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946143)"; flow:established,from_client; content:"GET"; http_method; content:"/api/settings/windows"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"trickgs-demo.vercel.app"; http_host; depth:23; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946143/; classtype:trojan-activity;sid:84809243; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946144)"; flow:established,from_client; content:"GET"; http_method; content:"/api/settings/mac"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"trickgs-demo.vercel.app"; http_host; depth:23; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946144/; classtype:trojan-activity;sid:84809244; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946142)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.127.73.15"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946142/; classtype:trojan-activity;sid:84809242; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946141)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"220.201.98.115"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946141/; classtype:trojan-activity;sid:84809241; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946140)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.206.110.121"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946140/; classtype:trojan-activity;sid:84809240; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946139)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.149.88.179"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946139/; classtype:trojan-activity;sid:84809239; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946134)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"36.88.136.194"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946134/; classtype:trojan-activity;sid:84809234; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946135)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"39.63.156.12"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946135/; classtype:trojan-activity;sid:84809235; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946136)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"208.102.160.191"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946136/; classtype:trojan-activity;sid:84809236; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946137)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.52.221.245"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946137/; classtype:trojan-activity;sid:84809237; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946138)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.190.192.166"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946138/; classtype:trojan-activity;sid:84809238; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946131)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.10.70.76"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946131/; classtype:trojan-activity;sid:84809231; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946132)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.202.187.80"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946132/; classtype:trojan-activity;sid:84809232; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946133)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"208.102.160.191"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946133/; classtype:trojan-activity;sid:84809233; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946129)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.237.57.159"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946129/; classtype:trojan-activity;sid:84809229; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946130)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.43.34.132"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946130/; classtype:trojan-activity;sid:84809230; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946128)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.169.0.215"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946128/; classtype:trojan-activity;sid:84809228; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946127)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"190.103.69.44"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946127/; classtype:trojan-activity;sid:84809227; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946125)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.184.179.135"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946125/; classtype:trojan-activity;sid:84809225; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946126)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"61.52.221.245"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946126/; classtype:trojan-activity;sid:84809226; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946123)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"81.229.105.156"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946123/; classtype:trojan-activity;sid:84809223; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946124)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"112.248.162.236"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946124/; classtype:trojan-activity;sid:84809224; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946122)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"45.168.132.19"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946122/; classtype:trojan-activity;sid:84809222; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946121)"; flow:established,from_client; content:"GET"; http_method; content:"/amkadmm.txt"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"31.40.204.114"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946121/; classtype:trojan-activity;sid:84809221; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946120)"; flow:established,from_client; content:"GET"; http_method; content:"/fast/geen.ps1"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"23.132.164.15"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946120/; classtype:trojan-activity;sid:84809220; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946118)"; flow:established,from_client; content:"GET"; http_method; content:"/fast/gg.ps1"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"23.132.164.15"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946118/; classtype:trojan-activity;sid:84809218; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946119)"; flow:established,from_client; content:"GET"; http_method; content:"/fast/secured_stub.ps1"; http_uri; depth:22; isdataat:!1,relative; nocase; content:"23.132.164.15"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946119/; classtype:trojan-activity;sid:84809219; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946117)"; flow:established,from_client; content:"GET"; http_method; content:"/fast/ttessttt.ps1"; http_uri; depth:18; isdataat:!1,relative; nocase; content:"23.132.164.15"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946117/; classtype:trojan-activity;sid:84809217; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946116)"; flow:established,from_client; content:"GET"; http_method; content:"/fast/ss.ps1"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"23.132.164.15"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946116/; classtype:trojan-activity;sid:84809216; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946115)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"112.248.162.236"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946115/; classtype:trojan-activity;sid:84809215; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946114)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.169.0.215"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946114/; classtype:trojan-activity;sid:84809214; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946112)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"219.157.239.239"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946112/; classtype:trojan-activity;sid:84809212; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946113)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.11.96.21"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946113/; classtype:trojan-activity;sid:84809213; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946111)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"39.82.142.95"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946111/; classtype:trojan-activity;sid:84809211; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946110)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"117.88.227.121"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946110/; classtype:trojan-activity;sid:84809210; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946108)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.52.197.166"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946108/; classtype:trojan-activity;sid:84809208; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946109)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"81.229.105.156"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946109/; classtype:trojan-activity;sid:84809209; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946107)"; flow:established,from_client; content:"GET"; http_method; content:"/fps/oocjafe.txt"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"nd.tdpqnf.com"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946107/; classtype:trojan-activity;sid:84809207; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946106)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"120.28.164.12"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946106/; classtype:trojan-activity;sid:84809206; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946105)"; flow:established,from_client; content:"GET"; http_method; content:"/files-129312398/files/file_7df6c134d8cd42cd.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"91.92.242.236"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946105/; classtype:trojan-activity;sid:84809205; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946104)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.227.139.105"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946104/; classtype:trojan-activity;sid:84809204; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946103)"; flow:established,from_client; content:"GET"; http_method; content:"/pandoras_box/pandora.arm4"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"176.65.149.45"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946103/; classtype:trojan-activity;sid:84809203; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946101)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"163.142.94.154"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946101/; classtype:trojan-activity;sid:84809201; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946102)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.197.62.42"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946102/; classtype:trojan-activity;sid:84809202; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946100)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.28.144.161"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946100/; classtype:trojan-activity;sid:84809200; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946099)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.157.239.239"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946099/; classtype:trojan-activity;sid:84809199; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946096)"; flow:established,from_client; content:"GET"; http_method; content:"/jklsh4"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"176.65.139.40"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946096/; classtype:trojan-activity;sid:84809196; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946097)"; flow:established,from_client; content:"GET"; http_method; content:"/jklmpsl"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"176.65.139.40"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946097/; classtype:trojan-activity;sid:84809197; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946098)"; flow:established,from_client; content:"GET"; http_method; content:"/jklm68k"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"176.65.139.40"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946098/; classtype:trojan-activity;sid:84809198; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946092)"; flow:established,from_client; content:"GET"; http_method; content:"/jklppc"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"176.65.139.40"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946092/; classtype:trojan-activity;sid:84809192; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946093)"; flow:established,from_client; content:"GET"; http_method; content:"/jklspc"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"176.65.139.40"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946093/; classtype:trojan-activity;sid:84809193; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946094)"; flow:established,from_client; content:"GET"; http_method; content:"/jklx86"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"176.65.139.40"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946094/; classtype:trojan-activity;sid:84809194; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946095)"; flow:established,from_client; content:"GET"; http_method; content:"/jklmips"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"176.65.139.40"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946095/; classtype:trojan-activity;sid:84809195; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946088)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.40.153.124"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946088/; classtype:trojan-activity;sid:84809188; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946089)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.42.122.31"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946089/; classtype:trojan-activity;sid:84809189; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946090)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.14.222.197"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946090/; classtype:trojan-activity;sid:84809190; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946091)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.206.175.175"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946091/; classtype:trojan-activity;sid:84809191; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946087)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.127.177.231"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946087/; classtype:trojan-activity;sid:84809187; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946086)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.137.93.208"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946086/; classtype:trojan-activity;sid:84809186; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946085)"; flow:established,from_client; content:"GET"; http_method; content:"/pandoras_box/pandora.ppc"; http_uri; depth:25; isdataat:!1,relative; nocase; content:"176.65.149.45"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946085/; classtype:trojan-activity;sid:84809185; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946084)"; flow:established,from_client; content:"GET"; http_method; content:"/pandoras_box/pandora.x86"; http_uri; depth:25; isdataat:!1,relative; nocase; content:"176.65.149.45"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946084/; classtype:trojan-activity;sid:84809184; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946077)"; flow:established,from_client; content:"GET"; http_method; content:"/pandoras_box/pandora.sh4"; http_uri; depth:25; isdataat:!1,relative; nocase; content:"176.65.149.45"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946077/; classtype:trojan-activity;sid:84809177; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946078)"; flow:established,from_client; content:"GET"; http_method; content:"/pandoras_box/pandora.mpsl"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"176.65.149.45"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946078/; classtype:trojan-activity;sid:84809178; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946079)"; flow:established,from_client; content:"GET"; http_method; content:"/pandoras_box/pandora.m68k"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"176.65.149.45"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946079/; classtype:trojan-activity;sid:84809179; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946080)"; flow:established,from_client; content:"GET"; http_method; content:"/pandoras_box/pandora.mips"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"176.65.149.45"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946080/; classtype:trojan-activity;sid:84809180; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946081)"; flow:established,from_client; content:"GET"; http_method; content:"/pandoras_box/pandora.arm7"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"176.65.149.45"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946081/; classtype:trojan-activity;sid:84809181; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946082)"; flow:established,from_client; content:"GET"; http_method; content:"/pandoras_box/pandora.arm6"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"176.65.149.45"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946082/; classtype:trojan-activity;sid:84809182; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946083)"; flow:established,from_client; content:"GET"; http_method; content:"/pandoras_box/pandora.arm5"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"176.65.149.45"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946083/; classtype:trojan-activity;sid:84809183; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946075)"; flow:established,from_client; content:"GET"; http_method; content:"/pandoras_box/pandora.arm"; http_uri; depth:25; isdataat:!1,relative; nocase; content:"176.65.149.45"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946075/; classtype:trojan-activity;sid:84809175; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946076)"; flow:established,from_client; content:"GET"; http_method; content:"/pandora.sh"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"176.65.149.45"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946076/; classtype:trojan-activity;sid:84809176; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946061)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/xnxnxnxnxnxnxnxnor1kxnxn"; http_uri; depth:30; isdataat:!1,relative; nocase; content:"94.183.174.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946061/; classtype:trojan-activity;sid:84809161; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946062)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/xnxnxnxnxnxnxnxnpowerpcxnxn"; http_uri; depth:33; isdataat:!1,relative; nocase; content:"94.183.174.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946062/; classtype:trojan-activity;sid:84809162; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946063)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/xnxnxnxnxnxnxnxni386xnxn"; http_uri; depth:30; isdataat:!1,relative; nocase; content:"94.183.174.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946063/; classtype:trojan-activity;sid:84809163; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946064)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/xnxnxnxnxnxnxnxnriscv32xnxn"; http_uri; depth:33; isdataat:!1,relative; nocase; content:"94.183.174.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946064/; classtype:trojan-activity;sid:84809164; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946065)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/xnxnxnxnxnxnxnxnloongarch64xnxn"; http_uri; depth:37; isdataat:!1,relative; nocase; content:"94.183.174.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946065/; classtype:trojan-activity;sid:84809165; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946066)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/xnxnxnxnxnxnxnxnm68kxnxn"; http_uri; depth:30; isdataat:!1,relative; nocase; content:"94.183.174.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946066/; classtype:trojan-activity;sid:84809166; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946067)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/xnxnxnxnxnxnxnxnmicroblazexnxn"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"94.183.174.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946067/; classtype:trojan-activity;sid:84809167; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946068)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/xnxnxnxnxnxnxnxnmipsxnxn"; http_uri; depth:30; isdataat:!1,relative; nocase; content:"94.183.174.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946068/; classtype:trojan-activity;sid:84809168; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946069)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/xnxnxnxnxnxnxnxnx86_64xnxn"; http_uri; depth:32; isdataat:!1,relative; nocase; content:"94.183.174.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946069/; classtype:trojan-activity;sid:84809169; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946070)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/xnxnxnxnxnxnxnxnsh2xnxn"; http_uri; depth:29; isdataat:!1,relative; nocase; content:"94.183.174.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946070/; classtype:trojan-activity;sid:84809170; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946071)"; flow:established,from_client; content:"GET"; http_method; content:"/run.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"94.183.174.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946071/; classtype:trojan-activity;sid:84809171; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946072)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/xnxnxnxnxnxnxnxnsh4xnxn"; http_uri; depth:29; isdataat:!1,relative; nocase; content:"94.183.174.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946072/; classtype:trojan-activity;sid:84809172; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946073)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/xnxnxnxnxnxnxnxnriscv64xnxn"; http_uri; depth:33; isdataat:!1,relative; nocase; content:"94.183.174.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946073/; classtype:trojan-activity;sid:84809173; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946074)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/xnxnxnxnxnxnxnxnaarch64xnxn"; http_uri; depth:33; isdataat:!1,relative; nocase; content:"94.183.174.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946074/; classtype:trojan-activity;sid:84809174; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946060)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.58.106.125"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946060/; classtype:trojan-activity;sid:84809160; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946058)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.51.182.83"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946058/; classtype:trojan-activity;sid:84809158; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946059)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.85.120.118"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946059/; classtype:trojan-activity;sid:84809159; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946057)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.85.165.214"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946057/; classtype:trojan-activity;sid:84809157; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946052)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.42.122.31"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946052/; classtype:trojan-activity;sid:84809152; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946053)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.206.175.175"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946053/; classtype:trojan-activity;sid:84809153; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946054)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"119.187.197.115"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946054/; classtype:trojan-activity;sid:84809154; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946055)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.227.139.165"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946055/; classtype:trojan-activity;sid:84809155; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946056)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"187.110.223.227"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946056/; classtype:trojan-activity;sid:84809156; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946051)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.8.8.177"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946051/; classtype:trojan-activity;sid:84809151; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946049)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"187.110.223.227"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946049/; classtype:trojan-activity;sid:84809149; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946050)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.127.177.231"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946050/; classtype:trojan-activity;sid:84809150; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946047)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"195.64.163.238"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946047/; classtype:trojan-activity;sid:84809147; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946048)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.234.99.214"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946048/; classtype:trojan-activity;sid:84809148; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946043)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/byte.x86"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"176.65.139.206"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946043/; classtype:trojan-activity;sid:84809143; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946044)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/byte.sh4"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"176.65.139.206"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946044/; classtype:trojan-activity;sid:84809144; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946045)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/byte.arm"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"176.65.139.206"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946045/; classtype:trojan-activity;sid:84809145; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946046)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/byte.mpsl"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"176.65.139.206"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946046/; classtype:trojan-activity;sid:84809146; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946039)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/byte.arm6"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"176.65.139.206"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946039/; classtype:trojan-activity;sid:84809139; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946040)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/byte.mips"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"176.65.139.206"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946040/; classtype:trojan-activity;sid:84809140; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946041)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/byte.arm5"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"176.65.139.206"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946041/; classtype:trojan-activity;sid:84809141; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946042)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/byte.arm7"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"176.65.139.206"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946042/; classtype:trojan-activity;sid:84809142; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946036)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/byte.i586"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"176.65.139.206"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946036/; classtype:trojan-activity;sid:84809136; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946037)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/byte.i486"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"176.65.139.206"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946037/; classtype:trojan-activity;sid:84809137; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946038)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/byte.powerpc"; http_uri; depth:18; isdataat:!1,relative; nocase; content:"176.65.139.206"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946038/; classtype:trojan-activity;sid:84809138; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946033)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.227.139.165"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946033/; classtype:trojan-activity;sid:84809133; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946034)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"58.255.43.208"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946034/; classtype:trojan-activity;sid:84809134; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946035)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.47.218.42"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946035/; classtype:trojan-activity;sid:84809135; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946031)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.169.236.217"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946031/; classtype:trojan-activity;sid:84809131; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946032)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"200.115.102.246"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946032/; classtype:trojan-activity;sid:84809132; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946030)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"39.40.140.64"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946030/; classtype:trojan-activity;sid:84809130; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946029)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"180.190.240.131"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946029/; classtype:trojan-activity;sid:84809129; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946028)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"45.166.188.48"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946028/; classtype:trojan-activity;sid:84809128; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946027)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"119.179.30.73"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946027/; classtype:trojan-activity;sid:84809127; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946026)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"112.113.175.13"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946026/; classtype:trojan-activity;sid:84809126; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946025)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.184.107.97"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946025/; classtype:trojan-activity;sid:84809125; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946022)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.28.164.12"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946022/; classtype:trojan-activity;sid:84809122; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946023)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.162.15.66"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946023/; classtype:trojan-activity;sid:84809123; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946024)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.137.93.208"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946024/; classtype:trojan-activity;sid:84809124; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946021)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"112.113.175.13"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946021/; classtype:trojan-activity;sid:84809121; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946020)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.127.179.145"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946020/; classtype:trojan-activity;sid:84809120; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946019)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.138.78.101"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946019/; classtype:trojan-activity;sid:84809119; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946017)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.52.16.97"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946017/; classtype:trojan-activity;sid:84809117; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946018)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"180.190.240.131"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946018/; classtype:trojan-activity;sid:84809118; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946016)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"78.188.196.206"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946016/; classtype:trojan-activity;sid:84809116; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946015)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"45.168.132.19"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946015/; classtype:trojan-activity;sid:84809115; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946014)"; flow:established,from_client; content:"GET"; http_method; content:"/furiousfade/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946014/; classtype:trojan-activity;sid:84809114; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946012)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.160.220.86"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946012/; classtype:trojan-activity;sid:84809112; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946013)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.229.175.66"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946013/; classtype:trojan-activity;sid:84809113; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946009)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"61.52.213.183"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946009/; classtype:trojan-activity;sid:84809109; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946010)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"120.84.214.178"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946010/; classtype:trojan-activity;sid:84809110; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946011)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.169.236.217"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946011/; classtype:trojan-activity;sid:84809111; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946008)"; flow:established,from_client; content:"GET"; http_method; content:"/sorellyc/swift-executor/head/swift.exe"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946008/; classtype:trojan-activity;sid:84809108; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946007)"; flow:established,from_client; content:"GET"; http_method; content:"/12312d12e1/31/releases/download/michael/bundle.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946007/; classtype:trojan-activity;sid:84809107; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946006)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/421625572146544650/1557485873053040820/bundle.zip|3f|backend=b2|7c|26|7c|ex=6ac7f940|7c|26|7c|is=6ac6a7c0|7c|26|7c|hm=21e27832c6b4e6ca2b2ea4e2fd13d863307d2fbc370e0ddaf0aa734c2d0a7b22|7c|26|7c|"; http_uri; depth:205; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946006/; classtype:trojan-activity;sid:84809106; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946004)"; flow:established,from_client; content:"GET"; http_method; content:"/jennybenz/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946004/; classtype:trojan-activity;sid:84809104; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946005)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/421625572146544650/1557483240623710298/bundle.zip|3f|backend=b2|7c|26|7c|ex=6ac7f6cd|7c|26|7c|is=6ac6a54d|7c|26|7c|hm=70027c5d396acff855a795907353c704ac0f7984562f173941ce2c381098eb57|7c|26|7c|"; http_uri; depth:205; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946005/; classtype:trojan-activity;sid:84809105; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946003)"; flow:established,from_client; content:"GET"; http_method; content:"/darkmodss/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946003/; classtype:trojan-activity;sid:84809103; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946001)"; flow:established,from_client; content:"GET"; http_method; content:"/kl1ssfa/c2panel/head/c2panel.exe"; http_uri; depth:33; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946001/; classtype:trojan-activity;sid:84809101; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946002)"; flow:established,from_client; content:"GET"; http_method; content:"/rockystars/fivem-external-cheat-33102/-/raw/main/loader.exe"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946002/; classtype:trojan-activity;sid:84809102; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945999)"; flow:established,from_client; content:"GET"; http_method; content:"/twistaflow/fortnitespoofer/-/raw/main/fortnitespoofer.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945999/; classtype:trojan-activity;sid:84809099; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3946000)"; flow:established,from_client; content:"GET"; http_method; content:"/britishway/genshin-impact-private-cheat-with-spoofer/-/raw/main/akebigc.exe"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3946000/; classtype:trojan-activity;sid:84809100; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945997)"; flow:established,from_client; content:"GET"; http_method; content:"/noelfeelin/xeno-executor/-/raw/main/xenoexecutor.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945997/; classtype:trojan-activity;sid:84809097; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945998)"; flow:established,from_client; content:"GET"; http_method; content:"/monsterkiller00k/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945998/; classtype:trojan-activity;sid:84809098; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945996)"; flow:established,from_client; content:"GET"; http_method; content:"/vampscore/fivem-external-cheat/-/raw/main/loader.exe"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945996/; classtype:trojan-activity;sid:84809096; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945995)"; flow:established,from_client; content:"GET"; http_method; content:"/layssh0/c2panel/head/c2panel.exe"; http_uri; depth:33; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945995/; classtype:trojan-activity;sid:84809095; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945994)"; flow:established,from_client; content:"GET"; http_method; content:"/tiffanyscore/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:118; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945994/; classtype:trojan-activity;sid:84809094; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945992)"; flow:established,from_client; content:"GET"; http_method; content:"/whitelines/genshin-impact-private-cheat-with-spoofer/-/raw/main/akebigc.exe"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945992/; classtype:trojan-activity;sid:84809092; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945993)"; flow:established,from_client; content:"GET"; http_method; content:"/ladycage/eulencheats-fivem/-/raw/main/loader.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945993/; classtype:trojan-activity;sid:84809093; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945990)"; flow:established,from_client; content:"GET"; http_method; content:"/claryfine/temp-spoofer-lifetime/-/raw/main/temp-spoofer.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945990/; classtype:trojan-activity;sid:84809090; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945991)"; flow:established,from_client; content:"GET"; http_method; content:"/amnesiacalms/fivem-external-cheat/-/raw/main/loader.exe"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945991/; classtype:trojan-activity;sid:84809091; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945989)"; flow:established,from_client; content:"GET"; http_method; content:"/daregods/skriptgg/-/raw/main/skriptgg.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945989/; classtype:trojan-activity;sid:84809089; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945988)"; flow:established,from_client; content:"GET"; http_method; content:"/raindroped/monotone-hwid-spoofer/-/raw/main/monotone-hwid-spoofer-master.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945988/; classtype:trojan-activity;sid:84809088; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945987)"; flow:established,from_client; content:"GET"; http_method; content:"/brjs5fcrfsoawqvux9xq"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"cdn.filestackcontent.com"; http_host; depth:24; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945987/; classtype:trojan-activity;sid:84809087; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945982)"; flow:established,from_client; content:"GET"; http_method; content:"/centralmods/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945982/; classtype:trojan-activity;sid:84809082; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945983)"; flow:established,from_client; content:"GET"; http_method; content:"/missgracess/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945983/; classtype:trojan-activity;sid:84809083; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945984)"; flow:established,from_client; content:"GET"; http_method; content:"/camunlocks/fortnitespoofer/-/raw/main/fortnitespoofer.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945984/; classtype:trojan-activity;sid:84809084; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945985)"; flow:established,from_client; content:"GET"; http_method; content:"/andyrolls/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945985/; classtype:trojan-activity;sid:84809085; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945986)"; flow:established,from_client; content:"GET"; http_method; content:"/bodycat/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945986/; classtype:trojan-activity;sid:84809086; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945981)"; flow:established,from_client; content:"GET"; http_method; content:"/curl.sh"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"176.65.139.40"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945981/; classtype:trojan-activity;sid:84809081; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945980)"; flow:established,from_client; content:"GET"; http_method; content:"/southhood/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945980/; classtype:trojan-activity;sid:84809080; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945978)"; flow:established,from_client; content:"GET"; http_method; content:"/lampage3/fivem-cheat-with-lua-executor-and-dumper/head/loader.exe"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945978/; classtype:trojan-activity;sid:84809078; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945979)"; flow:established,from_client; content:"GET"; http_method; content:"/fireplane/redengine-fivem/-/raw/main/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945979/; classtype:trojan-activity;sid:84809079; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945976)"; flow:established,from_client; content:"GET"; http_method; content:"/enginedevs/redengine-fivem/-/raw/main/loader.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945976/; classtype:trojan-activity;sid:84809076; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945977)"; flow:established,from_client; content:"GET"; http_method; content:"/ericknutty/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945977/; classtype:trojan-activity;sid:84809077; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945975)"; flow:established,from_client; content:"GET"; http_method; content:"/eversply/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945975/; classtype:trojan-activity;sid:84809075; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945967)"; flow:established,from_client; content:"GET"; http_method; content:"/lapurtk1n/fluxusexecutor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945967/; classtype:trojan-activity;sid:84809067; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945968)"; flow:established,from_client; content:"GET"; http_method; content:"/recklessstyle/fortnitespoofer/-/raw/main/fortnitespoofer.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945968/; classtype:trojan-activity;sid:84809068; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945969)"; flow:established,from_client; content:"GET"; http_method; content:"/madglint/temp-spoofer-lifetime/-/raw/main/temp-spoofer.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945969/; classtype:trojan-activity;sid:84809069; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945970)"; flow:established,from_client; content:"GET"; http_method; content:"/salivaenergy/genshin-impact-private-cheat-with-spoofer/-/raw/main/akebigc.exe"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945970/; classtype:trojan-activity;sid:84809070; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945971)"; flow:established,from_client; content:"GET"; http_method; content:"/r3tard3dn1gg3r/hwid-spoofer/-/raw/main/universalspoofer.exe"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945971/; classtype:trojan-activity;sid:84809071; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945972)"; flow:established,from_client; content:"GET"; http_method; content:"/shan1al/c2panel/head/c2panel.exe"; http_uri; depth:33; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945972/; classtype:trojan-activity;sid:84809072; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945973)"; flow:established,from_client; content:"GET"; http_method; content:"/brandonhills/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:118; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945973/; classtype:trojan-activity;sid:84809073; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945974)"; flow:established,from_client; content:"GET"; http_method; content:"/graymid/tinnylieh/-/raw/main/79k5p6k67h63.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945974/; classtype:trojan-activity;sid:84809074; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945962)"; flow:established,from_client; content:"GET"; http_method; content:"/shanecall/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945962/; classtype:trojan-activity;sid:84809062; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945963)"; flow:established,from_client; content:"GET"; http_method; content:"/m1ramme/fivem-external-cheat/head/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945963/; classtype:trojan-activity;sid:84809063; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945964)"; flow:established,from_client; content:"GET"; http_method; content:"/huntyexiles/pubg-desync-menu/head/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945964/; classtype:trojan-activity;sid:84809064; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945965)"; flow:established,from_client; content:"GET"; http_method; content:"/britneyspears/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:119; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945965/; classtype:trojan-activity;sid:84809065; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945966)"; flow:established,from_client; content:"GET"; http_method; content:"/lordfall/warzoneexternalcheat-42512/-/raw/main/loader.exe"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945966/; classtype:trojan-activity;sid:84809066; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945961)"; flow:established,from_client; content:"GET"; http_method; content:"/flizzlebeep/valorantexternalcheat/head/loader.exe"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945961/; classtype:trojan-activity;sid:84809061; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945960)"; flow:established,from_client; content:"GET"; http_method; content:"/akkil1fe/temp-spoofer-lifetime/-/raw/main/temp-spoofer.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945960/; classtype:trojan-activity;sid:84809060; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945959)"; flow:established,from_client; content:"GET"; http_method; content:"/renn1chls/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945959/; classtype:trojan-activity;sid:84809059; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945956)"; flow:established,from_client; content:"GET"; http_method; content:"/vvhsa/phoenixc2/head/phoenixc2.exe"; http_uri; depth:35; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945956/; classtype:trojan-activity;sid:84809056; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945957)"; flow:established,from_client; content:"GET"; http_method; content:"/mobydevs/genshin-impact-private-cheat-with-spoofer/-/raw/main/akebigc.exe"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945957/; classtype:trojan-activity;sid:84809057; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945958)"; flow:established,from_client; content:"GET"; http_method; content:"/beyondstyle/fivem-tz-project/-/raw/main/tz_project.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945958/; classtype:trojan-activity;sid:84809058; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945950)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.56.147.183"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945950/; classtype:trojan-activity;sid:84809050; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945951)"; flow:established,from_client; content:"GET"; http_method; content:"/prittery/fivem-external-cheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945951/; classtype:trojan-activity;sid:84809051; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945952)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.117.71.204"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945952/; classtype:trojan-activity;sid:84809052; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945953)"; flow:established,from_client; content:"GET"; http_method; content:"/jklarm5"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"176.65.139.40"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945953/; classtype:trojan-activity;sid:84809053; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945954)"; flow:established,from_client; content:"GET"; http_method; content:"/draggelons/fortniteexternalcheat/head/loader.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945954/; classtype:trojan-activity;sid:84809054; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945955)"; flow:established,from_client; content:"GET"; http_method; content:"/vaitrex/fivem-cheat-with-lua-executor-and-dumper/head/loader.exe"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945955/; classtype:trojan-activity;sid:84809055; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945949)"; flow:established,from_client; content:"GET"; http_method; content:"/r0undshann/phoenixc2/head/phoenixc2.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945949/; classtype:trojan-activity;sid:84809049; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945947)"; flow:established,from_client; content:"GET"; http_method; content:"/darkobenz/fivem-spoofer/-/raw/main/fivemspoofer.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945947/; classtype:trojan-activity;sid:84809047; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945948)"; flow:established,from_client; content:"GET"; http_method; content:"/limmaplessh/valorantexternalcheat/head/loader.exe"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945948/; classtype:trojan-activity;sid:84809048; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945946)"; flow:established,from_client; content:"GET"; http_method; content:"/conzully/pubg-desync-menu/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945946/; classtype:trojan-activity;sid:84809046; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945943)"; flow:established,from_client; content:"GET"; http_method; content:"/alterbridge/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945943/; classtype:trojan-activity;sid:84809043; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945944)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenflows/silentum-spoofer/-/raw/main/silentumspoofer.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945944/; classtype:trojan-activity;sid:84809044; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945945)"; flow:established,from_client; content:"GET"; http_method; content:"/louiremble/fivem-mod-menu/-/raw/main/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945945/; classtype:trojan-activity;sid:84809045; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945941)"; flow:established,from_client; content:"GET"; http_method; content:"/ainnessceth/roblox-macro-v3.0.0/head/spencer%20macro%20client.exe"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945941/; classtype:trojan-activity;sid:84809041; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945942)"; flow:established,from_client; content:"GET"; http_method; content:"/barriels/fivem-mod-menu/head/loader.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945942/; classtype:trojan-activity;sid:84809042; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945940)"; flow:established,from_client; content:"GET"; http_method; content:"/escaless/skriptgg/head/skriptgg.exe"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945940/; classtype:trojan-activity;sid:84809040; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945938)"; flow:established,from_client; content:"GET"; http_method; content:"/duntees/fluxus-executor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945938/; classtype:trojan-activity;sid:84809038; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945939)"; flow:established,from_client; content:"GET"; http_method; content:"/alennciruous/valorantexternalcheat/head/loader.exe"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945939/; classtype:trojan-activity;sid:84809039; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945936)"; flow:established,from_client; content:"GET"; http_method; content:"/realness/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945936/; classtype:trojan-activity;sid:84809036; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945937)"; flow:established,from_client; content:"GET"; http_method; content:"/snaffl3k/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945937/; classtype:trojan-activity;sid:84809037; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945932)"; flow:established,from_client; content:"GET"; http_method; content:"/chrisrule/fivem-tz-project/-/raw/main/tz_project.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945932/; classtype:trojan-activity;sid:84809032; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945933)"; flow:established,from_client; content:"GET"; http_method; content:"/x86_64"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"45.9.149.168"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945933/; classtype:trojan-activity;sid:84809033; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945934)"; flow:established,from_client; content:"GET"; http_method; content:"/spellytfx/xeno-executor/head/xeno.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945934/; classtype:trojan-activity;sid:84809034; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945935)"; flow:established,from_client; content:"GET"; http_method; content:"/axielles/pubg-desync-menu/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945935/; classtype:trojan-activity;sid:84809035; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945929)"; flow:established,from_client; content:"GET"; http_method; content:"/harnelly/warzone-dominator/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945929/; classtype:trojan-activity;sid:84809029; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945930)"; flow:established,from_client; content:"GET"; http_method; content:"/shaerrlys/fivem-spoofer/head/cfxbypass.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945930/; classtype:trojan-activity;sid:84809030; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945931)"; flow:established,from_client; content:"GET"; http_method; content:"/rainsofpist/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945931/; classtype:trojan-activity;sid:84809031; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945925)"; flow:established,from_client; content:"GET"; http_method; content:"/raceway/redengine-fivem/-/raw/main/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945925/; classtype:trojan-activity;sid:84809025; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945926)"; flow:established,from_client; content:"GET"; http_method; content:"/1meonl1f/warzoneexternalcheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945926/; classtype:trojan-activity;sid:84809026; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945927)"; flow:established,from_client; content:"GET"; http_method; content:"/darkfantasy/monotone-hwid-spoofer/-/raw/main/monotone-hwid-spoofer-master.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945927/; classtype:trojan-activity;sid:84809027; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945928)"; flow:established,from_client; content:"GET"; http_method; content:"/socialwares/fluxus-executor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945928/; classtype:trojan-activity;sid:84809028; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945922)"; flow:established,from_client; content:"GET"; http_method; content:"/amelisy/fivem-external-cheat/head/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945922/; classtype:trojan-activity;sid:84809022; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945923)"; flow:established,from_client; content:"GET"; http_method; content:"/mertzdev1/valorantexternalcheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945923/; classtype:trojan-activity;sid:84809023; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945924)"; flow:established,from_client; content:"GET"; http_method; content:"/ivsoryeh/phoenixc2/head/phoenixc2.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945924/; classtype:trojan-activity;sid:84809024; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945921)"; flow:established,from_client; content:"GET"; http_method; content:"/lanofierry/skriptgg/head/skriptgg.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945921/; classtype:trojan-activity;sid:84809021; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945920)"; flow:established,from_client; content:"GET"; http_method; content:"/sullenst/valorantexternalcheat/head/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945920/; classtype:trojan-activity;sid:84809020; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945918)"; flow:established,from_client; content:"GET"; http_method; content:"/files-129312398/files/file_4e463941a19f86ca.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"91.92.242.236"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945918/; classtype:trojan-activity;sid:84809018; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945919)"; flow:established,from_client; content:"GET"; http_method; content:"/api/cm-token"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"beschaffung-portal.de"; http_host; depth:21; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945919/; classtype:trojan-activity;sid:84809019; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945909)"; flow:established,from_client; content:"GET"; http_method; content:"/queensmile/fortnite-ragdoll-v2-privcheat-including-softaim-esp-wallhack-triggerbot-and-more/-/raw/main/loader.exe"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945909/; classtype:trojan-activity;sid:84809009; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945910)"; flow:established,from_client; content:"GET"; http_method; content:"/expensiveram/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:118; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945910/; classtype:trojan-activity;sid:84809010; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945911)"; flow:established,from_client; content:"GET"; http_method; content:"/gleeshplace/warzoneexternalcheat/-/raw/main/loader.exe"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945911/; classtype:trojan-activity;sid:84809011; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945912)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.12.229.137"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945912/; classtype:trojan-activity;sid:84809012; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945913)"; flow:established,from_client; content:"GET"; http_method; content:"/c1ehrr/valorantexternalcheat/head/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945913/; classtype:trojan-activity;sid:84809013; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945914)"; flow:established,from_client; content:"GET"; http_method; content:"/terr19/roblox-macro-v3.0.0/head/spencer%20macro%20client.exe"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945914/; classtype:trojan-activity;sid:84809014; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945915)"; flow:established,from_client; content:"GET"; http_method; content:"/rainformage/verox-gta-enhanced/head/verox.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945915/; classtype:trojan-activity;sid:84809015; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945916)"; flow:established,from_client; content:"GET"; http_method; content:"/minepluss/skriptgg/head/skriptgg.exe"; http_uri; depth:37; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945916/; classtype:trojan-activity;sid:84809016; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945917)"; flow:established,from_client; content:"GET"; http_method; content:"/bleddymight/skriptgg/head/skriptgg.exe"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945917/; classtype:trojan-activity;sid:84809017; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945905)"; flow:established,from_client; content:"GET"; http_method; content:"/api/cm-token"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"evergabe-bund.de"; http_host; depth:16; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945905/; classtype:trojan-activity;sid:84809005; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945906)"; flow:established,from_client; content:"GET"; http_method; content:"/markendows/fivem-external-cheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945906/; classtype:trojan-activity;sid:84809006; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945907)"; flow:established,from_client; content:"GET"; http_method; content:"/rudeboyy/monotone-hwid-spoofer/-/raw/main/monotone-hwid-spoofer-master.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945907/; classtype:trojan-activity;sid:84809007; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945908)"; flow:established,from_client; content:"GET"; http_method; content:"/nixxywors/redengine-fivem/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945908/; classtype:trojan-activity;sid:84809008; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945904)"; flow:established,from_client; content:"GET"; http_method; content:"/h1endless/phoenixc2/head/phoenixc2.exe"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945904/; classtype:trojan-activity;sid:84809004; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945902)"; flow:established,from_client; content:"GET"; http_method; content:"/terrhl/roblox-macro-v3.0.0/head/spencer%20macro%20client.exe"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945902/; classtype:trojan-activity;sid:84809002; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945903)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.190.69.149"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945903/; classtype:trojan-activity;sid:84809003; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945900)"; flow:established,from_client; content:"GET"; http_method; content:"/hannesye/fortniteexternalcheat/head/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945900/; classtype:trojan-activity;sid:84809000; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945901)"; flow:established,from_client; content:"GET"; http_method; content:"/s.ps1"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"stanarcservice.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945901/; classtype:trojan-activity;sid:84809001; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945899)"; flow:established,from_client; content:"GET"; http_method; content:"/mackneck/silentum-spoofer/-/raw/main/silentumspoofer.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945899/; classtype:trojan-activity;sid:84808999; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945898)"; flow:established,from_client; content:"GET"; http_method; content:"/shantywss/fivem-spoofer/head/cfxbypass.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945898/; classtype:trojan-activity;sid:84808998; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945895)"; flow:established,from_client; content:"GET"; http_method; content:"/risselys/swift-executor/head/swift.exe"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945895/; classtype:trojan-activity;sid:84808995; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945896)"; flow:established,from_client; content:"GET"; http_method; content:"/jklarm6"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"176.65.139.40"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945896/; classtype:trojan-activity;sid:84808996; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945897)"; flow:established,from_client; content:"GET"; http_method; content:"/hornettsky/fortnitespoofer/-/raw/main/fortnitespoofer.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945897/; classtype:trojan-activity;sid:84808997; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945892)"; flow:established,from_client; content:"GET"; http_method; content:"/flokkysway/fivem-tz-project/-/raw/main/tz_project.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945892/; classtype:trojan-activity;sid:84808992; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945893)"; flow:established,from_client; content:"GET"; http_method; content:"/bradfleek/monotone-hwid-spoofer/-/raw/main/monotone-hwid-spoofer-master.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945893/; classtype:trojan-activity;sid:84808993; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945894)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.12.108.39"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945894/; classtype:trojan-activity;sid:84808994; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945888)"; flow:established,from_client; content:"GET"; http_method; content:"/h1fflexd/phoenixc2/head/phoenixc2.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945888/; classtype:trojan-activity;sid:84808988; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945889)"; flow:established,from_client; content:"GET"; http_method; content:"/flyenspride/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945889/; classtype:trojan-activity;sid:84808989; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945890)"; flow:established,from_client; content:"GET"; http_method; content:"/archesst/warzone-dominator/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945890/; classtype:trojan-activity;sid:84808990; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945891)"; flow:established,from_client; content:"GET"; http_method; content:"/seetherx/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945891/; classtype:trojan-activity;sid:84808991; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945885)"; flow:established,from_client; content:"GET"; http_method; content:"/drawpool/fluxus-executor-53343/-/raw/main/fluxusexecutor.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945885/; classtype:trojan-activity;sid:84808985; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945886)"; flow:established,from_client; content:"GET"; http_method; content:"/rainyforce/fortnitespoofer/-/raw/main/fortnitespoofer.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945886/; classtype:trojan-activity;sid:84808986; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945887)"; flow:established,from_client; content:"GET"; http_method; content:"/lemmapys/redengine-fivem/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945887/; classtype:trojan-activity;sid:84808987; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945883)"; flow:established,from_client; content:"GET"; http_method; content:"/trecch1n/redengine-fivem/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945883/; classtype:trojan-activity;sid:84808983; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945884)"; flow:established,from_client; content:"GET"; http_method; content:"/railthits/fluxus-executor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945884/; classtype:trojan-activity;sid:84808984; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945881)"; flow:established,from_client; content:"GET"; http_method; content:"/jaydoublee/fortniteexternalcheat/head/loader.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945881/; classtype:trojan-activity;sid:84808981; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945882)"; flow:established,from_client; content:"GET"; http_method; content:"/rillend/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945882/; classtype:trojan-activity;sid:84808982; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945880)"; flow:established,from_client; content:"GET"; http_method; content:"/lordfall/warzoneexternalcheat-84738/-/raw/main/loader.exe"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945880/; classtype:trojan-activity;sid:84808980; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945879)"; flow:established,from_client; content:"GET"; http_method; content:"/files-129312398/files/file_ae2d99ac73163300.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"91.92.242.236"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945879/; classtype:trojan-activity;sid:84808979; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945877)"; flow:established,from_client; content:"GET"; http_method; content:"/earlyshot/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945877/; classtype:trojan-activity;sid:84808977; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945878)"; flow:established,from_client; content:"GET"; http_method; content:"/goldlife/fortnite-ragdoll-v2-privcheat-including-softaim-esp-wallhack-triggerbot-and-more/-/raw/main/loader.exe"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945878/; classtype:trojan-activity;sid:84808978; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945875)"; flow:established,from_client; content:"GET"; http_method; content:"/mewhills/fivem-external-cheat/-/raw/main/loader.exe"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945875/; classtype:trojan-activity;sid:84808975; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945876)"; flow:established,from_client; content:"GET"; http_method; content:"/drawpool/fluxus-executor-69039/-/raw/main/fluxusexecutor.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945876/; classtype:trojan-activity;sid:84808976; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945872)"; flow:established,from_client; content:"GET"; http_method; content:"/ameliamodel/fivem-mod-menu/-/raw/main/loader.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945872/; classtype:trojan-activity;sid:84808972; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945873)"; flow:established,from_client; content:"GET"; http_method; content:"/slerthrgb/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945873/; classtype:trojan-activity;sid:84808973; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945874)"; flow:established,from_client; content:"GET"; http_method; content:"/ryanghost/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945874/; classtype:trojan-activity;sid:84808974; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945869)"; flow:established,from_client; content:"GET"; http_method; content:"/crandd1/fivem-spoofer/head/cfxbypass.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945869/; classtype:trojan-activity;sid:84808969; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945870)"; flow:established,from_client; content:"GET"; http_method; content:"/phasecart/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945870/; classtype:trojan-activity;sid:84808970; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945871)"; flow:established,from_client; content:"GET"; http_method; content:"/vanesslys/skriptgg/head/skriptgg.exe"; http_uri; depth:37; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945871/; classtype:trojan-activity;sid:84808971; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945866)"; flow:established,from_client; content:"GET"; http_method; content:"/t1nellyne/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945866/; classtype:trojan-activity;sid:84808966; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945867)"; flow:established,from_client; content:"GET"; http_method; content:"/lionbest/fluxus-executor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945867/; classtype:trojan-activity;sid:84808967; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945868)"; flow:established,from_client; content:"GET"; http_method; content:"/drawpool/fluxus-executor-25917/-/raw/main/fluxusexecutor.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945868/; classtype:trojan-activity;sid:84808968; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945864)"; flow:established,from_client; content:"GET"; http_method; content:"/mianickel/fluxus-executor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945864/; classtype:trojan-activity;sid:84808964; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945865)"; flow:established,from_client; content:"GET"; http_method; content:"/chztreik/fivem-external-cheat/-/raw/main/loader.exe"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945865/; classtype:trojan-activity;sid:84808965; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945863)"; flow:established,from_client; content:"GET"; http_method; content:"/wilow/runner_ilove.exe"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"107.175.82.242"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945863/; classtype:trojan-activity;sid:84808963; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945862)"; flow:established,from_client; content:"GET"; http_method; content:"/littleviews/swift-executor/head/swift.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945862/; classtype:trojan-activity;sid:84808962; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945861)"; flow:established,from_client; content:"GET"; http_method; content:"/albaees/fivem-external-cheat/head/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945861/; classtype:trojan-activity;sid:84808961; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945858)"; flow:established,from_client; content:"GET"; http_method; content:"/lianxang/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945858/; classtype:trojan-activity;sid:84808958; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945859)"; flow:established,from_client; content:"GET"; http_method; content:"/blazingfasts/xeno-executor/-/raw/main/xenoexecutor.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945859/; classtype:trojan-activity;sid:84808959; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945860)"; flow:established,from_client; content:"GET"; http_method; content:"/shockriver/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945860/; classtype:trojan-activity;sid:84808960; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945855)"; flow:established,from_client; content:"GET"; http_method; content:"/get-lin"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"reaffirm-neatness-rigid.ngrok-free.dev"; http_host; depth:38; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945855/; classtype:trojan-activity;sid:84808955; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945856)"; flow:established,from_client; content:"GET"; http_method; content:"/brandycut/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945856/; classtype:trojan-activity;sid:84808956; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945857)"; flow:established,from_client; content:"GET"; http_method; content:"/beepdevs/fluxus-executor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945857/; classtype:trojan-activity;sid:84808957; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945853)"; flow:established,from_client; content:"GET"; http_method; content:"/colleshake/fivem-spoofer/head/cfxbypass.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945853/; classtype:trojan-activity;sid:84808953; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945854)"; flow:established,from_client; content:"GET"; http_method; content:"/nineslicks/redengine-fivem/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945854/; classtype:trojan-activity;sid:84808954; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945852)"; flow:established,from_client; content:"GET"; http_method; content:"/w3stcoast/akebi-gc/head/akebi-gc.exe"; http_uri; depth:37; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945852/; classtype:trojan-activity;sid:84808952; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945851)"; flow:established,from_client; content:"GET"; http_method; content:"/strephon.dias/redengine-fivem/-/raw/main/loader.exe"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945851/; classtype:trojan-activity;sid:84808951; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945850)"; flow:established,from_client; content:"GET"; http_method; content:"/ganseiss/redengine-fivem/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945850/; classtype:trojan-activity;sid:84808950; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945849)"; flow:established,from_client; content:"GET"; http_method; content:"/api/cm-token"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"bergmann-automobile.de"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945849/; classtype:trojan-activity;sid:84808949; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945841)"; flow:established,from_client; content:"GET"; http_method; content:"/nyassol/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945841/; classtype:trojan-activity;sid:84808941; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945842)"; flow:established,from_client; content:"GET"; http_method; content:"/wget.sh"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"176.65.139.40"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945842/; classtype:trojan-activity;sid:84808942; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945843)"; flow:established,from_client; content:"GET"; http_method; content:"/creelsens/redengine-fivem/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945843/; classtype:trojan-activity;sid:84808943; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945844)"; flow:established,from_client; content:"GET"; http_method; content:"/aidenlovs/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945844/; classtype:trojan-activity;sid:84808944; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945845)"; flow:established,from_client; content:"GET"; http_method; content:"/tzxdevs/fivem-cheat-with-lua-executor-and-dumper/head/loader.exe"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945845/; classtype:trojan-activity;sid:84808945; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945846)"; flow:established,from_client; content:"GET"; http_method; content:"/alientruths/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945846/; classtype:trojan-activity;sid:84808946; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945847)"; flow:established,from_client; content:"GET"; http_method; content:"/l0vemillage/valorantexternalcheat/head/loader.exe"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945847/; classtype:trojan-activity;sid:84808947; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945848)"; flow:established,from_client; content:"GET"; http_method; content:"/meinderrty/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945848/; classtype:trojan-activity;sid:84808948; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945838)"; flow:established,from_client; content:"GET"; http_method; content:"/wenllishx/dma-spoofer/head/dma_spoofer.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945838/; classtype:trojan-activity;sid:84808938; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945839)"; flow:established,from_client; content:"GET"; http_method; content:"/offthe1an/phoenixc2/head/phoenixc2.exe"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945839/; classtype:trojan-activity;sid:84808939; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945840)"; flow:established,from_client; content:"GET"; http_method; content:"/criesty/pubg-desync-menu/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945840/; classtype:trojan-activity;sid:84808940; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945837)"; flow:established,from_client; content:"GET"; http_method; content:"/clainmeers/solara/head/solara%20v3.exe"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945837/; classtype:trojan-activity;sid:84808937; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945835)"; flow:established,from_client; content:"GET"; http_method; content:"/hammeis/fivem-external-cheat/head/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945835/; classtype:trojan-activity;sid:84808935; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945836)"; flow:established,from_client; content:"GET"; http_method; content:"/insomnia2008/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:118; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945836/; classtype:trojan-activity;sid:84808936; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945832)"; flow:established,from_client; content:"GET"; http_method; content:"/hansytruth/rezo-gen/head/rezogen.exe"; http_uri; depth:37; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945832/; classtype:trojan-activity;sid:84808932; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945833)"; flow:established,from_client; content:"GET"; http_method; content:"/phineplane/fortniteexternalcheat/head/loader.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945833/; classtype:trojan-activity;sid:84808933; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945834)"; flow:established,from_client; content:"GET"; http_method; content:"/luckhonny/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945834/; classtype:trojan-activity;sid:84808934; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945831)"; flow:established,from_client; content:"GET"; http_method; content:"/lordfall/warzoneexternalcheat-44974/-/raw/main/loader.exe"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945831/; classtype:trojan-activity;sid:84808931; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945826)"; flow:established,from_client; content:"GET"; http_method; content:"/socialtime/eulencheats-fivem/-/raw/main/loader.exe"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945826/; classtype:trojan-activity;sid:84808926; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945827)"; flow:established,from_client; content:"GET"; http_method; content:"/t3zw0rk/temp-spoofer-lifetime/-/raw/main/temp-spoofer.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945827/; classtype:trojan-activity;sid:84808927; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945828)"; flow:established,from_client; content:"GET"; http_method; content:"/nationgloglo/skriptgg/-/raw/main/skriptgg.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945828/; classtype:trojan-activity;sid:84808928; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945829)"; flow:established,from_client; content:"GET"; http_method; content:"/minellysweb/skriptgg/head/skriptgg.exe"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945829/; classtype:trojan-activity;sid:84808929; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945830)"; flow:established,from_client; content:"GET"; http_method; content:"/pitclicks/eulencheats-fivem/-/raw/main/loader.exe"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945830/; classtype:trojan-activity;sid:84808930; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945824)"; flow:established,from_client; content:"GET"; http_method; content:"/crystaldior/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945824/; classtype:trojan-activity;sid:84808924; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945825)"; flow:established,from_client; content:"GET"; http_method; content:"/flowmindss/skriptgg/-/raw/main/skriptgg.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945825/; classtype:trojan-activity;sid:84808925; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945823)"; flow:established,from_client; content:"GET"; http_method; content:"/just1nnlcsh/phoenixc2/head/phoenixc2.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945823/; classtype:trojan-activity;sid:84808923; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945822)"; flow:established,from_client; content:"GET"; http_method; content:"/hexxycally/code/-/raw/main/w52ue52xby31.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945822/; classtype:trojan-activity;sid:84808922; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945821)"; flow:established,from_client; content:"GET"; http_method; content:"/musslygoch/eulencheats-fivem/head/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945821/; classtype:trojan-activity;sid:84808921; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945819)"; flow:established,from_client; content:"GET"; http_method; content:"/aidenmill/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945819/; classtype:trojan-activity;sid:84808919; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945820)"; flow:established,from_client; content:"GET"; http_method; content:"/layevv/fivem-mod-menu/head/loader.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945820/; classtype:trojan-activity;sid:84808920; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945815)"; flow:established,from_client; content:"GET"; http_method; content:"/rreval1is/phoenixc2/head/phoenixc2.exe"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945815/; classtype:trojan-activity;sid:84808915; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945816)"; flow:established,from_client; content:"GET"; http_method; content:"/swimmingpools/monotone-hwid-spoofer/-/raw/main/monotone-hwid-spoofer-master.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945816/; classtype:trojan-activity;sid:84808916; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945817)"; flow:established,from_client; content:"GET"; http_method; content:"/drawpool/fluxus-executor-64534/-/raw/main/fluxusexecutor.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945817/; classtype:trojan-activity;sid:84808917; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945818)"; flow:established,from_client; content:"GET"; http_method; content:"/cluelimsy/fivem-cheat-with-lua-executor-and-dumper/head/loader.exe"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945818/; classtype:trojan-activity;sid:84808918; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945812)"; flow:established,from_client; content:"GET"; http_method; content:"/pierlymoat/fortniteexternalcheat/head/loader.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945812/; classtype:trojan-activity;sid:84808912; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945813)"; flow:established,from_client; content:"GET"; http_method; content:"/mnesshv1/pubg-desync-menu/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945813/; classtype:trojan-activity;sid:84808913; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945814)"; flow:established,from_client; content:"GET"; http_method; content:"/tarm1ss/solara/head/solara%20v3.exe"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945814/; classtype:trojan-activity;sid:84808914; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945810)"; flow:established,from_client; content:"GET"; http_method; content:"/lienx7/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945810/; classtype:trojan-activity;sid:84808910; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945811)"; flow:established,from_client; content:"GET"; http_method; content:"/riverrystore/swift-executor/head/swift.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945811/; classtype:trojan-activity;sid:84808911; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945809)"; flow:established,from_client; content:"GET"; http_method; content:"/linorous/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945809/; classtype:trojan-activity;sid:84808909; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945804)"; flow:established,from_client; content:"GET"; http_method; content:"/horneyddjs/xeno-executor/head/xeno.exe"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945804/; classtype:trojan-activity;sid:84808904; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945805)"; flow:established,from_client; content:"GET"; http_method; content:"/kknalh/warzoneexternalcheat/head/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945805/; classtype:trojan-activity;sid:84808905; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945806)"; flow:established,from_client; content:"GET"; http_method; content:"/narr1h/skriptgg/head/skriptgg.exe"; http_uri; depth:34; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945806/; classtype:trojan-activity;sid:84808906; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945807)"; flow:established,from_client; content:"GET"; http_method; content:"/ellisdraw/fivem-mod-menu/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945807/; classtype:trojan-activity;sid:84808907; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945808)"; flow:established,from_client; content:"GET"; http_method; content:"/parellys/skriptgg/head/skriptgg.exe"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945808/; classtype:trojan-activity;sid:84808908; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945802)"; flow:established,from_client; content:"GET"; http_method; content:"/igmp24184/roblox-macro-v3.0.0/head/language/roblo-macr-v2.1.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945802/; classtype:trojan-activity;sid:84808902; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945803)"; flow:established,from_client; content:"GET"; http_method; content:"/seriouslycat/fluxus-roblox-executor/head/fluxus%20v7.exe"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945803/; classtype:trojan-activity;sid:84808903; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945800)"; flow:established,from_client; content:"GET"; http_method; content:"/rockwws/warzone-dominator/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945800/; classtype:trojan-activity;sid:84808900; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945801)"; flow:established,from_client; content:"GET"; http_method; content:"/madstreets/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945801/; classtype:trojan-activity;sid:84808901; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945798)"; flow:established,from_client; content:"GET"; http_method; content:"/el1nns/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945798/; classtype:trojan-activity;sid:84808898; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945799)"; flow:established,from_client; content:"GET"; http_method; content:"/sherkdss/warzone-dominator/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945799/; classtype:trojan-activity;sid:84808899; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945779)"; flow:established,from_client; content:"GET"; http_method; content:"/breakingnova/fivem-external-cheat/-/raw/main/loader.exe"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945779/; classtype:trojan-activity;sid:84808879; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945780)"; flow:established,from_client; content:"GET"; http_method; content:"/thearrms/monotone-hwid-spoofer/-/raw/main/monotone-hwid-spoofer-master.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945780/; classtype:trojan-activity;sid:84808880; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945781)"; flow:established,from_client; content:"GET"; http_method; content:"/blizzardstep/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:118; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945781/; classtype:trojan-activity;sid:84808881; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945782)"; flow:established,from_client; content:"GET"; http_method; content:"/kristirogers/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945782/; classtype:trojan-activity;sid:84808882; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945783)"; flow:established,from_client; content:"GET"; http_method; content:"/maddycat/temp-spoofer-lifetime/-/raw/main/temp-spoofer.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945783/; classtype:trojan-activity;sid:84808883; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945784)"; flow:established,from_client; content:"GET"; http_method; content:"/janelees/temp-spoofer-lifetime/-/raw/main/temp-spoofer.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945784/; classtype:trojan-activity;sid:84808884; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945785)"; flow:established,from_client; content:"GET"; http_method; content:"/billyjet/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945785/; classtype:trojan-activity;sid:84808885; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945786)"; flow:established,from_client; content:"GET"; http_method; content:"/devilhunt/fortnite-ragdoll-v2-privcheat-including-softaim-esp-wallhack-triggerbot-and-more/-/raw/main/loader.exe"; http_uri; depth:113; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945786/; classtype:trojan-activity;sid:84808886; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945787)"; flow:established,from_client; content:"GET"; http_method; content:"/fivemstory/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945787/; classtype:trojan-activity;sid:84808887; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945788)"; flow:established,from_client; content:"GET"; http_method; content:"/hexxycally/code/-/raw/main/7pgv5x7885t8.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945788/; classtype:trojan-activity;sid:84808888; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945789)"; flow:established,from_client; content:"GET"; http_method; content:"/hungup/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945789/; classtype:trojan-activity;sid:84808889; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945790)"; flow:established,from_client; content:"GET"; http_method; content:"/rockystars/fivem-external-cheat-78473/-/raw/main/loader.exe"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945790/; classtype:trojan-activity;sid:84808890; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945791)"; flow:established,from_client; content:"GET"; http_method; content:"/meil1s/quantv-january/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945791/; classtype:trojan-activity;sid:84808891; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945792)"; flow:established,from_client; content:"GET"; http_method; content:"/nightmaressy/warzoneexternalcheat/-/raw/main/loader.exe"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945792/; classtype:trojan-activity;sid:84808892; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945793)"; flow:established,from_client; content:"GET"; http_method; content:"/expertthief/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945793/; classtype:trojan-activity;sid:84808893; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945794)"; flow:established,from_client; content:"GET"; http_method; content:"/sapphireworld/valorantexternalcheat/-/raw/main/loader.exe"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945794/; classtype:trojan-activity;sid:84808894; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945795)"; flow:established,from_client; content:"GET"; http_method; content:"/zlefth/warzoneexternalcheat/head/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945795/; classtype:trojan-activity;sid:84808895; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945796)"; flow:established,from_client; content:"GET"; http_method; content:"/teoraze/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945796/; classtype:trojan-activity;sid:84808896; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945797)"; flow:established,from_client; content:"GET"; http_method; content:"/clarr1ns/pubg-desync-menu/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945797/; classtype:trojan-activity;sid:84808897; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945766)"; flow:established,from_client; content:"GET"; http_method; content:"/jetwater/fivem-mod-menu/-/raw/main/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945766/; classtype:trojan-activity;sid:84808866; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945767)"; flow:established,from_client; content:"GET"; http_method; content:"/nccerx/roblox-macro-v3.0.0/head/spencer%20macro%20client.exe"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945767/; classtype:trojan-activity;sid:84808867; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945768)"; flow:established,from_client; content:"GET"; http_method; content:"/graymid/tinnylieh/-/raw/main/factor5323.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945768/; classtype:trojan-activity;sid:84808868; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945769)"; flow:established,from_client; content:"GET"; http_method; content:"/lordfall/warzoneexternalcheat-51072/-/raw/main/loader.exe"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945769/; classtype:trojan-activity;sid:84808869; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945770)"; flow:established,from_client; content:"GET"; http_method; content:"/skyedges/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945770/; classtype:trojan-activity;sid:84808870; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945771)"; flow:established,from_client; content:"GET"; http_method; content:"/stonerighhend/fortniteexternalcheat/head/loader.exe"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945771/; classtype:trojan-activity;sid:84808871; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945772)"; flow:established,from_client; content:"GET"; http_method; content:"/carrl1e/eulencheats-fivem/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945772/; classtype:trojan-activity;sid:84808872; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945773)"; flow:established,from_client; content:"GET"; http_method; content:"/charreyc/redengine-fivem/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945773/; classtype:trojan-activity;sid:84808873; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945774)"; flow:established,from_client; content:"GET"; http_method; content:"/galbiaawi/galbiaawi-project67/-/raw/main/testing53.exe"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945774/; classtype:trojan-activity;sid:84808874; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945775)"; flow:established,from_client; content:"GET"; http_method; content:"/consines/warzone-dominator/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945775/; classtype:trojan-activity;sid:84808875; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945776)"; flow:established,from_client; content:"GET"; http_method; content:"/worldsky/fivem-spoofer/-/raw/main/fivemspoofer.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945776/; classtype:trojan-activity;sid:84808876; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945777)"; flow:established,from_client; content:"GET"; http_method; content:"/darkyf0x/fluxus-roblox-executor/head/fluxus%20v7.exe"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945777/; classtype:trojan-activity;sid:84808877; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945778)"; flow:established,from_client; content:"GET"; http_method; content:"/neonfeat/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945778/; classtype:trojan-activity;sid:84808878; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945765)"; flow:established,from_client; content:"GET"; http_method; content:"/bringloves/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945765/; classtype:trojan-activity;sid:84808865; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945763)"; flow:established,from_client; content:"GET"; http_method; content:"/lilbabys/fivem-external-cheat/-/raw/main/loader.exe"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945763/; classtype:trojan-activity;sid:84808863; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945764)"; flow:established,from_client; content:"GET"; http_method; content:"/brealstage3h/c2panel/head/c2panel.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945764/; classtype:trojan-activity;sid:84808864; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945762)"; flow:established,from_client; content:"GET"; http_method; content:"/sellxd/roblox-macro-v3.0.0/head/spencer%20macro%20client.exe"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945762/; classtype:trojan-activity;sid:84808862; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945759)"; flow:established,from_client; content:"GET"; http_method; content:"/avv3rral/c2panel/head/c2panel.exe"; http_uri; depth:34; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945759/; classtype:trojan-activity;sid:84808859; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945760)"; flow:established,from_client; content:"GET"; http_method; content:"/grannywayss/valorantexternalcheat/head/loader.exe"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945760/; classtype:trojan-activity;sid:84808860; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945761)"; flow:established,from_client; content:"GET"; http_method; content:"/davenorth/fivem-external-cheat/-/raw/main/loader.exe"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945761/; classtype:trojan-activity;sid:84808861; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945757)"; flow:established,from_client; content:"GET"; http_method; content:"/venn1sol/dmdgo-v1.20.1/head/dmdgo%20v1.20.1/discord-mass-dm-go.exe"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945757/; classtype:trojan-activity;sid:84808857; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945758)"; flow:established,from_client; content:"GET"; http_method; content:"/bestclims/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945758/; classtype:trojan-activity;sid:84808858; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945756)"; flow:established,from_client; content:"GET"; http_method; content:"/burnstate/fivem-external-cheat/-/raw/main/loader.exe"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945756/; classtype:trojan-activity;sid:84808856; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945754)"; flow:established,from_client; content:"GET"; http_method; content:"/gre3ah2/warzoneexternalcheat/head/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945754/; classtype:trojan-activity;sid:84808854; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945755)"; flow:established,from_client; content:"GET"; http_method; content:"/baldeeh/eulencheats-fivem/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945755/; classtype:trojan-activity;sid:84808855; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945752)"; flow:established,from_client; content:"GET"; http_method; content:"/err1ys/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945752/; classtype:trojan-activity;sid:84808852; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945753)"; flow:established,from_client; content:"GET"; http_method; content:"/wherres/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945753/; classtype:trojan-activity;sid:84808853; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945751)"; flow:established,from_client; content:"GET"; http_method; content:"/sharrely/fortniteexternalcheat/head/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945751/; classtype:trojan-activity;sid:84808851; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945749)"; flow:established,from_client; content:"GET"; http_method; content:"/am1llsi/pubg-desync-menu/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945749/; classtype:trojan-activity;sid:84808849; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945750)"; flow:established,from_client; content:"GET"; http_method; content:"/triplebreezy/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945750/; classtype:trojan-activity;sid:84808850; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945748)"; flow:established,from_client; content:"GET"; http_method; content:"/ariem1ils/fivem-mod-menu/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945748/; classtype:trojan-activity;sid:84808848; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945745)"; flow:established,from_client; content:"GET"; http_method; content:"/mcd99/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945745/; classtype:trojan-activity;sid:84808845; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945746)"; flow:established,from_client; content:"GET"; http_method; content:"/finessesky/xeno-executor/-/raw/main/xenoexecutor.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945746/; classtype:trojan-activity;sid:84808846; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945747)"; flow:established,from_client; content:"GET"; http_method; content:"/jenncarter/valorantexternalcheat/-/raw/main/loader.exe"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945747/; classtype:trojan-activity;sid:84808847; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945744)"; flow:established,from_client; content:"GET"; http_method; content:"/hevvylines/exodus-larp-tool/head/exodus.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945744/; classtype:trojan-activity;sid:84808844; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945741)"; flow:established,from_client; content:"GET"; http_method; content:"/selli1nu/pubg-desync-menu/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945741/; classtype:trojan-activity;sid:84808841; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945742)"; flow:established,from_client; content:"GET"; http_method; content:"/hsnall/hwid-bypass/head/tempspoofer.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945742/; classtype:trojan-activity;sid:84808842; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945743)"; flow:established,from_client; content:"GET"; http_method; content:"/clydebee/fortnite-ragdoll-v2-privcheat-including-softaim-esp-wallhack-triggerbot-and-more/-/raw/main/loader.exe"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945743/; classtype:trojan-activity;sid:84808843; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945739)"; flow:established,from_client; content:"GET"; http_method; content:"/magicloves/skriptgg/-/raw/main/skriptgg.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945739/; classtype:trojan-activity;sid:84808839; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945740)"; flow:established,from_client; content:"GET"; http_method; content:"/andyhills/skriptgg/-/raw/main/skriptgg.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945740/; classtype:trojan-activity;sid:84808840; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945737)"; flow:established,from_client; content:"GET"; http_method; content:"/kevinhood/fivem-external-cheat/-/raw/main/loader.exe"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945737/; classtype:trojan-activity;sid:84808837; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945738)"; flow:established,from_client; content:"GET"; http_method; content:"/poloflocky/valorantexternalcheat/-/raw/main/loader.exe"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945738/; classtype:trojan-activity;sid:84808838; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945735)"; flow:established,from_client; content:"GET"; http_method; content:"/speedchase/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:116; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945735/; classtype:trojan-activity;sid:84808835; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945736)"; flow:established,from_client; content:"GET"; http_method; content:"/valkyriesys/xeno-executor/head/xeno.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945736/; classtype:trojan-activity;sid:84808836; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945731)"; flow:established,from_client; content:"GET"; http_method; content:"/cherrylight/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945731/; classtype:trojan-activity;sid:84808831; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945732)"; flow:established,from_client; content:"GET"; http_method; content:"/eevvral1sh/c2panel/head/c2panel.exe"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945732/; classtype:trojan-activity;sid:84808832; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945733)"; flow:established,from_client; content:"GET"; http_method; content:"/finrefront/skriptgg/head/skriptgg.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945733/; classtype:trojan-activity;sid:84808833; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945734)"; flow:established,from_client; content:"GET"; http_method; content:"/ssten1/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945734/; classtype:trojan-activity;sid:84808834; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945729)"; flow:established,from_client; content:"GET"; http_method; content:"/caslm3th/roblox-macro-v3.0.0/head/spencer%20macro%20client.exe"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945729/; classtype:trojan-activity;sid:84808829; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945730)"; flow:established,from_client; content:"GET"; http_method; content:"/allistatr/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945730/; classtype:trojan-activity;sid:84808830; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945726)"; flow:established,from_client; content:"GET"; http_method; content:"/fadeaways/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945726/; classtype:trojan-activity;sid:84808826; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945727)"; flow:established,from_client; content:"GET"; http_method; content:"/thewissh/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945727/; classtype:trojan-activity;sid:84808827; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945728)"; flow:established,from_client; content:"GET"; http_method; content:"/m1rryhs/roblox-macro-v3.0.0/head/spencer%20macro%20client.exe"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945728/; classtype:trojan-activity;sid:84808828; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945724)"; flow:established,from_client; content:"GET"; http_method; content:"/reversegunz/fivem-tz-project/-/raw/main/tz_project.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945724/; classtype:trojan-activity;sid:84808824; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945725)"; flow:established,from_client; content:"GET"; http_method; content:"/annerclith/pubg-desync-menu/head/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945725/; classtype:trojan-activity;sid:84808825; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945723)"; flow:established,from_client; content:"GET"; http_method; content:"/switchylanes/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945723/; classtype:trojan-activity;sid:84808823; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945721)"; flow:established,from_client; content:"GET"; http_method; content:"/malibuchrome/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:118; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945721/; classtype:trojan-activity;sid:84808821; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945722)"; flow:established,from_client; content:"GET"; http_method; content:"/nithellys/skriptgg/head/skriptgg.exe"; http_uri; depth:37; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945722/; classtype:trojan-activity;sid:84808822; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945717)"; flow:established,from_client; content:"GET"; http_method; content:"/rootfailures/vision-rage-fortnite-privatecheat/head/loader.exe"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945717/; classtype:trojan-activity;sid:84808817; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945718)"; flow:established,from_client; content:"GET"; http_method; content:"/ixsteff/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945718/; classtype:trojan-activity;sid:84808818; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945719)"; flow:established,from_client; content:"GET"; http_method; content:"/blacktier/monotone-hwid-spoofer/-/raw/main/monotone-hwid-spoofer-master.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945719/; classtype:trojan-activity;sid:84808819; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945720)"; flow:established,from_client; content:"GET"; http_method; content:"/narrel1s/fivem-external-cheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945720/; classtype:trojan-activity;sid:84808820; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945711)"; flow:established,from_client; content:"GET"; http_method; content:"/l0rdn0s/phoenixc2/head/phoenixc2.exe"; http_uri; depth:37; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945711/; classtype:trojan-activity;sid:84808811; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945712)"; flow:established,from_client; content:"GET"; http_method; content:"/calleplee/fivem-external-cheat/head/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945712/; classtype:trojan-activity;sid:84808812; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945713)"; flow:established,from_client; content:"GET"; http_method; content:"/h1endlls/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945713/; classtype:trojan-activity;sid:84808813; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945714)"; flow:established,from_client; content:"GET"; http_method; content:"/sandyl1ns/fivem-mod-menu/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945714/; classtype:trojan-activity;sid:84808814; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945715)"; flow:established,from_client; content:"GET"; http_method; content:"/cazzarel/eulencheats-fivem/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945715/; classtype:trojan-activity;sid:84808815; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945716)"; flow:established,from_client; content:"GET"; http_method; content:"/cl0nerry/pubg-desync-menu/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945716/; classtype:trojan-activity;sid:84808816; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945710)"; flow:established,from_client; content:"GET"; http_method; content:"/lovegones/xeno-executor/-/raw/main/xenoexecutor.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945710/; classtype:trojan-activity;sid:84808810; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945709)"; flow:established,from_client; content:"GET"; http_method; content:"/runnyeps/redengine-fivem/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945709/; classtype:trojan-activity;sid:84808809; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945707)"; flow:established,from_client; content:"GET"; http_method; content:"/lfieeys/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945707/; classtype:trojan-activity;sid:84808807; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945708)"; flow:established,from_client; content:"GET"; http_method; content:"/primmslimx/fivem-spoofer/head/cfxbypass.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945708/; classtype:trojan-activity;sid:84808808; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945706)"; flow:established,from_client; content:"GET"; http_method; content:"/bialykoteg/redengine-fivem/-/raw/main/loader.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945706/; classtype:trojan-activity;sid:84808806; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945705)"; flow:established,from_client; content:"GET"; http_method; content:"/ycarocontas/skriptgg/-/raw/main/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945705/; classtype:trojan-activity;sid:84808805; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945697)"; flow:established,from_client; content:"GET"; http_method; content:"/failureh/redengine-fivem/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945697/; classtype:trojan-activity;sid:84808797; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945698)"; flow:established,from_client; content:"GET"; http_method; content:"/eistebells/pubg-desync-menu/head/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945698/; classtype:trojan-activity;sid:84808798; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945699)"; flow:established,from_client; content:"GET"; http_method; content:"/nicoleprince/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945699/; classtype:trojan-activity;sid:84808799; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945700)"; flow:established,from_client; content:"GET"; http_method; content:"/releasemylove/akebi-gc/head/akebi-gc.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945700/; classtype:trojan-activity;sid:84808800; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945701)"; flow:established,from_client; content:"GET"; http_method; content:"/nurelles/fivem-mod-menu/head/loader.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945701/; classtype:trojan-activity;sid:84808801; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945702)"; flow:established,from_client; content:"GET"; http_method; content:"/huntlegssy/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945702/; classtype:trojan-activity;sid:84808802; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945703)"; flow:established,from_client; content:"GET"; http_method; content:"/cnney28/pubg-desync-menu/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945703/; classtype:trojan-activity;sid:84808803; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945704)"; flow:established,from_client; content:"GET"; http_method; content:"/allansixs/warzone-dominator/head/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945704/; classtype:trojan-activity;sid:84808804; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945692)"; flow:established,from_client; content:"GET"; http_method; content:"/snowwress/valorantexternalcheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945692/; classtype:trojan-activity;sid:84808792; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945693)"; flow:established,from_client; content:"GET"; http_method; content:"/stoulla/fivem-external-cheat/head/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945693/; classtype:trojan-activity;sid:84808793; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945694)"; flow:established,from_client; content:"GET"; http_method; content:"/nteams/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945694/; classtype:trojan-activity;sid:84808794; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945695)"; flow:established,from_client; content:"GET"; http_method; content:"/huntylight/fivem-spoofer/head/cfxbypass.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945695/; classtype:trojan-activity;sid:84808795; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945696)"; flow:established,from_client; content:"GET"; http_method; content:"/gleemads/eulencheats-fivem/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945696/; classtype:trojan-activity;sid:84808796; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945691)"; flow:established,from_client; content:"GET"; http_method; content:"/remakks/skriptgg/head/skriptgg.exe"; http_uri; depth:35; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945691/; classtype:trojan-activity;sid:84808791; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945690)"; flow:established,from_client; content:"GET"; http_method; content:"/4rubbish/c2panel/head/c2panel.exe"; http_uri; depth:34; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945690/; classtype:trojan-activity;sid:84808790; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945689)"; flow:established,from_client; content:"GET"; http_method; content:"/ermix1/pubg-desync-menu/head/loader.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945689/; classtype:trojan-activity;sid:84808789; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945688)"; flow:established,from_client; content:"GET"; http_method; content:"/narrayel/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945688/; classtype:trojan-activity;sid:84808788; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945686)"; flow:established,from_client; content:"GET"; http_method; content:"/mywhoress/fivem-spoofer/head/cfxbypass.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945686/; classtype:trojan-activity;sid:84808786; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945687)"; flow:established,from_client; content:"GET"; http_method; content:"/flashrabbits/fortniteexternalcheat/head/loader.exe"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945687/; classtype:trojan-activity;sid:84808787; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945655)"; flow:established,from_client; content:"GET"; http_method; content:"/nativewayne/fluxus-executor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945655/; classtype:trojan-activity;sid:84808755; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945656)"; flow:established,from_client; content:"GET"; http_method; content:"/chromeofancy/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945656/; classtype:trojan-activity;sid:84808756; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945657)"; flow:established,from_client; content:"GET"; http_method; content:"/capproject/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945657/; classtype:trojan-activity;sid:84808757; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945658)"; flow:established,from_client; content:"GET"; http_method; content:"/tinygray/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945658/; classtype:trojan-activity;sid:84808758; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945659)"; flow:established,from_client; content:"GET"; http_method; content:"/lemussx/stalcraft-wh-chams-speedhack-fb/head/prg.rar"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945659/; classtype:trojan-activity;sid:84808759; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945660)"; flow:established,from_client; content:"GET"; http_method; content:"/j1kksy/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945660/; classtype:trojan-activity;sid:84808760; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945661)"; flow:established,from_client; content:"GET"; http_method; content:"/hexxycally/code/-/raw/main/y0xc9og1lghx.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945661/; classtype:trojan-activity;sid:84808761; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945662)"; flow:established,from_client; content:"GET"; http_method; content:"/rackzyes/vision-rage-fortnite-privatecheat/head/loader.exe"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945662/; classtype:trojan-activity;sid:84808762; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945663)"; flow:established,from_client; content:"GET"; http_method; content:"/kadenclimb/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945663/; classtype:trojan-activity;sid:84808763; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945664)"; flow:established,from_client; content:"GET"; http_method; content:"/hexxycally/code/-/raw/main/3qz7aatrn_q.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945664/; classtype:trojan-activity;sid:84808764; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945665)"; flow:established,from_client; content:"GET"; http_method; content:"/kannethlin/silentum-spoofer/-/raw/main/silentumspoofer.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945665/; classtype:trojan-activity;sid:84808765; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945666)"; flow:established,from_client; content:"GET"; http_method; content:"/nellyframe/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:116; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945666/; classtype:trojan-activity;sid:84808766; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945667)"; flow:established,from_client; content:"GET"; http_method; content:"/graymid/tinnylieh/-/raw/main/4j8576a0e8v3.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945667/; classtype:trojan-activity;sid:84808767; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945668)"; flow:established,from_client; content:"GET"; http_method; content:"/stonegrays/warzoneexternalcheat/-/raw/main/loader.exe"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945668/; classtype:trojan-activity;sid:84808768; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945669)"; flow:established,from_client; content:"GET"; http_method; content:"/hexxycally/code/-/raw/main/em1s573k9q2c.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945669/; classtype:trojan-activity;sid:84808769; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945670)"; flow:established,from_client; content:"GET"; http_method; content:"/addrav1/warzoneexternalcheat/head/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945670/; classtype:trojan-activity;sid:84808770; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945671)"; flow:established,from_client; content:"GET"; http_method; content:"/suspectengine/valorantexternalcheat/-/raw/main/loader.exe"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945671/; classtype:trojan-activity;sid:84808771; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945672)"; flow:established,from_client; content:"GET"; http_method; content:"/lovesplit/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945672/; classtype:trojan-activity;sid:84808772; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945673)"; flow:established,from_client; content:"GET"; http_method; content:"/willymore/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945673/; classtype:trojan-activity;sid:84808773; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945674)"; flow:established,from_client; content:"GET"; http_method; content:"/sidekill/warzoneexternalcheat/-/raw/main/loader.exe"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945674/; classtype:trojan-activity;sid:84808774; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945675)"; flow:established,from_client; content:"GET"; http_method; content:"/drakethug/redengine-fivem/-/raw/main/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945675/; classtype:trojan-activity;sid:84808775; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945676)"; flow:established,from_client; content:"GET"; http_method; content:"/laparks/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945676/; classtype:trojan-activity;sid:84808776; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945677)"; flow:established,from_client; content:"GET"; http_method; content:"/l3mmn1ia/fivem-mod-menu/head/loader.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945677/; classtype:trojan-activity;sid:84808777; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945678)"; flow:established,from_client; content:"GET"; http_method; content:"/earlreal/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945678/; classtype:trojan-activity;sid:84808778; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945679)"; flow:established,from_client; content:"GET"; http_method; content:"/linorech/fluxus-executor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945679/; classtype:trojan-activity;sid:84808779; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945680)"; flow:established,from_client; content:"GET"; http_method; content:"/flyingspur/fortnitespoofer/-/raw/main/fortnitespoofer.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945680/; classtype:trojan-activity;sid:84808780; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945681)"; flow:established,from_client; content:"GET"; http_method; content:"/twochainz/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945681/; classtype:trojan-activity;sid:84808781; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945682)"; flow:established,from_client; content:"GET"; http_method; content:"/davehoodie/fluxus-executor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945682/; classtype:trojan-activity;sid:84808782; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945683)"; flow:established,from_client; content:"GET"; http_method; content:"/m0llsbry/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945683/; classtype:trojan-activity;sid:84808783; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945684)"; flow:established,from_client; content:"GET"; http_method; content:"/lamirgh/pubg-desync-menu/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945684/; classtype:trojan-activity;sid:84808784; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945685)"; flow:established,from_client; content:"GET"; http_method; content:"/darlymigh/stalcraft-wh-chams-speedhack-fb/head/prg.rar"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945685/; classtype:trojan-activity;sid:84808785; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945654)"; flow:established,from_client; content:"GET"; http_method; content:"/bellyrocky/xeno-executor/head/xeno.exe"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945654/; classtype:trojan-activity;sid:84808754; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945653)"; flow:established,from_client; content:"GET"; http_method; content:"/jaybaby/fortnite-ragdoll-v2-privcheat-including-softaim-esp-wallhack-triggerbot-and-more/-/raw/main/loader.exe"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945653/; classtype:trojan-activity;sid:84808753; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945652)"; flow:established,from_client; content:"GET"; http_method; content:"/millionssky/monotone-hwid-spoofer/-/raw/main/monotone-hwid-spoofer-master.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945652/; classtype:trojan-activity;sid:84808752; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945649)"; flow:established,from_client; content:"GET"; http_method; content:"/deer1sh/fivem-mod-menu/head/loader.exe"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945649/; classtype:trojan-activity;sid:84808749; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945650)"; flow:established,from_client; content:"GET"; http_method; content:"/calld9/fivem-external-cheat/head/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945650/; classtype:trojan-activity;sid:84808750; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945651)"; flow:established,from_client; content:"GET"; http_method; content:"/nickelyblack/fortnitespoofer/-/raw/main/fortnitespoofer.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945651/; classtype:trojan-activity;sid:84808751; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945647)"; flow:established,from_client; content:"GET"; http_method; content:"/arielswaps/valorantexternalcheat/head/loader.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945647/; classtype:trojan-activity;sid:84808747; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945648)"; flow:established,from_client; content:"GET"; http_method; content:"/thebravery/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945648/; classtype:trojan-activity;sid:84808748; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945646)"; flow:established,from_client; content:"GET"; http_method; content:"/machertlin/swift-executor/head/swift.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945646/; classtype:trojan-activity;sid:84808746; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945644)"; flow:established,from_client; content:"GET"; http_method; content:"/hexxycally/code/-/raw/main/505hfzin80f5.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945644/; classtype:trojan-activity;sid:84808744; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945645)"; flow:established,from_client; content:"GET"; http_method; content:"/roachforever/fivem-spoofer/head/cfxbypass.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945645/; classtype:trojan-activity;sid:84808745; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945641)"; flow:established,from_client; content:"GET"; http_method; content:"/drawpool/fluxus-executor-35793/-/raw/main/fluxusexecutor.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945641/; classtype:trojan-activity;sid:84808741; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945642)"; flow:established,from_client; content:"GET"; http_method; content:"/maerlsss/valorantexternalcheat/head/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945642/; classtype:trojan-activity;sid:84808742; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945643)"; flow:established,from_client; content:"GET"; http_method; content:"/skappyx/fivem-mod-menu/head/loader.exe"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945643/; classtype:trojan-activity;sid:84808743; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945637)"; flow:established,from_client; content:"GET"; http_method; content:"/elissebell/valorantexternalcheat/head/loader.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945637/; classtype:trojan-activity;sid:84808737; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945638)"; flow:established,from_client; content:"GET"; http_method; content:"/seject/fivem-external-cheat/-/raw/main/loader.exe"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945638/; classtype:trojan-activity;sid:84808738; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945639)"; flow:established,from_client; content:"GET"; http_method; content:"/twowheel/wave-executor/-/raw/main/waveexecutor.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945639/; classtype:trojan-activity;sid:84808739; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945640)"; flow:established,from_client; content:"GET"; http_method; content:"/sadofmy/warzone-dominator/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945640/; classtype:trojan-activity;sid:84808740; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945635)"; flow:established,from_client; content:"GET"; http_method; content:"/captainhooks/fivem-spoofer/-/raw/main/fivemspoofer.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945635/; classtype:trojan-activity;sid:84808735; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945636)"; flow:established,from_client; content:"GET"; http_method; content:"/nickellys/roblox-macro-v3.0.0/head/spencer%20macro%20client.exe"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945636/; classtype:trojan-activity;sid:84808736; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945631)"; flow:established,from_client; content:"GET"; http_method; content:"/imaginsedragons/fortnitespoofer/-/raw/main/fortnitespoofer.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945631/; classtype:trojan-activity;sid:84808731; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945632)"; flow:established,from_client; content:"GET"; http_method; content:"/anclemidds/umbrella-hwid-tool/head/umbrella/umbrella.exe"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945632/; classtype:trojan-activity;sid:84808732; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945633)"; flow:established,from_client; content:"GET"; http_method; content:"/harrtys/fivem-external-cheat/head/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945633/; classtype:trojan-activity;sid:84808733; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945634)"; flow:established,from_client; content:"GET"; http_method; content:"/takinfly/fortnite-ragdoll-v2-privcheat-including-softaim-esp-wallhack-triggerbot-and-more/-/raw/main/loader.exe"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945634/; classtype:trojan-activity;sid:84808734; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945627)"; flow:established,from_client; content:"GET"; http_method; content:"/skannyesflam/valorantexternalcheat/head/loader.exe"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945627/; classtype:trojan-activity;sid:84808727; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945628)"; flow:established,from_client; content:"GET"; http_method; content:"/arcellys/fivem-spoofer/head/cfxbypass.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945628/; classtype:trojan-activity;sid:84808728; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945629)"; flow:established,from_client; content:"GET"; http_method; content:"/phantomfax/warzoneexternalcheat/-/raw/main/loader.exe"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945629/; classtype:trojan-activity;sid:84808729; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945630)"; flow:established,from_client; content:"GET"; http_method; content:"/highrivals/fivem-spoofer/-/raw/main/fivemspoofer.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945630/; classtype:trojan-activity;sid:84808730; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945626)"; flow:established,from_client; content:"GET"; http_method; content:"/blackstars/monotone-hwid-spoofer/-/raw/main/monotone-hwid-spoofer-master.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945626/; classtype:trojan-activity;sid:84808726; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945625)"; flow:established,from_client; content:"GET"; http_method; content:"/meekmill/monotone-hwid-spoofer/-/raw/main/monotone-hwid-spoofer-master.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945625/; classtype:trojan-activity;sid:84808725; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945624)"; flow:established,from_client; content:"GET"; http_method; content:"/in0ns3/fivem-mod-menu/head/loader.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945624/; classtype:trojan-activity;sid:84808724; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945621)"; flow:established,from_client; content:"GET"; http_method; content:"/nelccie/fivem-external-cheat/head/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945621/; classtype:trojan-activity;sid:84808721; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945622)"; flow:established,from_client; content:"GET"; http_method; content:"/grandstarx/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945622/; classtype:trojan-activity;sid:84808722; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945623)"; flow:established,from_client; content:"GET"; http_method; content:"/starfive/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945623/; classtype:trojan-activity;sid:84808723; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945619)"; flow:established,from_client; content:"GET"; http_method; content:"/theorlysix/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945619/; classtype:trojan-activity;sid:84808719; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945620)"; flow:established,from_client; content:"GET"; http_method; content:"/dailyscripts132/fivem-mod-menu/-/raw/main/loader.exe"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945620/; classtype:trojan-activity;sid:84808720; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945617)"; flow:established,from_client; content:"GET"; http_method; content:"/robloxexploiter/xeno-executor/-/raw/main/xeno.exe"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945617/; classtype:trojan-activity;sid:84808717; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945618)"; flow:established,from_client; content:"GET"; http_method; content:"/eliaseight/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945618/; classtype:trojan-activity;sid:84808718; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945614)"; flow:established,from_client; content:"GET"; http_method; content:"/nettywipes/fortnite-ragdoll-v2-privcheat-including-softaim-esp-wallhack-triggerbot-and-more/-/raw/main/loader.exe"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945614/; classtype:trojan-activity;sid:84808714; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945615)"; flow:established,from_client; content:"GET"; http_method; content:"/frankensteins/xeno-executor/-/raw/main/xenoexecutor.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945615/; classtype:trojan-activity;sid:84808715; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945616)"; flow:established,from_client; content:"GET"; http_method; content:"/standprince/genshin-impact-private-cheat-with-spoofer/-/raw/main/akebigc.exe"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945616/; classtype:trojan-activity;sid:84808716; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945613)"; flow:established,from_client; content:"GET"; http_method; content:"/railguns/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945613/; classtype:trojan-activity;sid:84808713; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945611)"; flow:established,from_client; content:"GET"; http_method; content:"/callyish/pubg-desync-menu/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945611/; classtype:trojan-activity;sid:84808711; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945612)"; flow:established,from_client; content:"GET"; http_method; content:"/santigold/xeno-executor/-/raw/main/xenoexecutor.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945612/; classtype:trojan-activity;sid:84808712; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945610)"; flow:established,from_client; content:"GET"; http_method; content:"/voidbest/fluxus-executor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945610/; classtype:trojan-activity;sid:84808710; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945608)"; flow:established,from_client; content:"GET"; http_method; content:"/blessytd/redengine-fivem/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945608/; classtype:trojan-activity;sid:84808708; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945609)"; flow:established,from_client; content:"GET"; http_method; content:"/yesst1s/skriptgg/head/skriptgg.exe"; http_uri; depth:35; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945609/; classtype:trojan-activity;sid:84808709; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945605)"; flow:established,from_client; content:"GET"; http_method; content:"/mixxyshev/solara/head/solara%20v3.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945605/; classtype:trojan-activity;sid:84808705; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945606)"; flow:established,from_client; content:"GET"; http_method; content:"/crattier/dma-spoofer/head/dma_spoofer.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945606/; classtype:trojan-activity;sid:84808706; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945607)"; flow:established,from_client; content:"GET"; http_method; content:"/brixst0ne/fortnitespoofer/-/raw/main/fortnitespoofer.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945607/; classtype:trojan-activity;sid:84808707; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945604)"; flow:established,from_client; content:"GET"; http_method; content:"/ellfect1ve/fivem-mod-menu-2024/head/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945604/; classtype:trojan-activity;sid:84808704; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945603)"; flow:established,from_client; content:"GET"; http_method; content:"/rapidflow/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945603/; classtype:trojan-activity;sid:84808703; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945600)"; flow:established,from_client; content:"GET"; http_method; content:"/crissty/monotone-hwid-spoofer/-/raw/main/monotone-hwid-spoofer-master.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945600/; classtype:trojan-activity;sid:84808700; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945601)"; flow:established,from_client; content:"GET"; http_method; content:"/hexxycally/code/-/raw/main/hello.exe"; http_uri; depth:37; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945601/; classtype:trojan-activity;sid:84808701; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945602)"; flow:established,from_client; content:"GET"; http_method; content:"/n1tteys/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945602/; classtype:trojan-activity;sid:84808702; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945597)"; flow:established,from_client; content:"GET"; http_method; content:"/bizzyshifts/monotone-hwid-spoofer/-/raw/main/monotone-hwid-spoofer-master.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945597/; classtype:trojan-activity;sid:84808697; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945598)"; flow:established,from_client; content:"GET"; http_method; content:"/jetlags/fortnitespoofer/-/raw/main/fortnitespoofer.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945598/; classtype:trojan-activity;sid:84808698; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945599)"; flow:established,from_client; content:"GET"; http_method; content:"/slowbenz/fluxus-executor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945599/; classtype:trojan-activity;sid:84808699; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945594)"; flow:established,from_client; content:"GET"; http_method; content:"/graymid/tinnylieh/-/raw/main/259uzds8poxh.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945594/; classtype:trojan-activity;sid:84808694; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945595)"; flow:established,from_client; content:"GET"; http_method; content:"/ollymade/redengine-fivem/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945595/; classtype:trojan-activity;sid:84808695; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945596)"; flow:established,from_client; content:"GET"; http_method; content:"/laurelios/warzone-dominator/head/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945596/; classtype:trojan-activity;sid:84808696; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945593)"; flow:established,from_client; content:"GET"; http_method; content:"/rickyflame/valorantexternalcheat/-/raw/main/loader.exe"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945593/; classtype:trojan-activity;sid:84808693; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945587)"; flow:established,from_client; content:"GET"; http_method; content:"/kaue9919a/skriptgg/-/raw/main/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945587/; classtype:trojan-activity;sid:84808687; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945588)"; flow:established,from_client; content:"GET"; http_method; content:"/lexxals/quantv-sp-fivem-ragemp-altv/head/_uninstall/quantv_uninstall.exe"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945588/; classtype:trojan-activity;sid:84808688; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945589)"; flow:established,from_client; content:"GET"; http_method; content:"/tillatens/pubg-desync-menu/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945589/; classtype:trojan-activity;sid:84808689; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945590)"; flow:established,from_client; content:"GET"; http_method; content:"/onceflix/silentum-spoofer/-/raw/main/silentumspoofer.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945590/; classtype:trojan-activity;sid:84808690; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945591)"; flow:established,from_client; content:"GET"; http_method; content:"/spinbacks/temp-spoofer-lifetime/-/raw/main/temp-spoofer.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945591/; classtype:trojan-activity;sid:84808691; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945592)"; flow:established,from_client; content:"GET"; http_method; content:"/rockystars/fivem-external-cheat-93402/-/raw/main/loader.exe"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945592/; classtype:trojan-activity;sid:84808692; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945582)"; flow:established,from_client; content:"GET"; http_method; content:"/vipergod/silentum-spoofer/-/raw/main/silentumspoofer.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945582/; classtype:trojan-activity;sid:84808682; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945583)"; flow:established,from_client; content:"GET"; http_method; content:"/rexrexs/valorantexternalcheat/-/raw/main/loader.exe"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945583/; classtype:trojan-activity;sid:84808683; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945584)"; flow:established,from_client; content:"GET"; http_method; content:"/skylends/pubg-desync-menu/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945584/; classtype:trojan-activity;sid:84808684; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945585)"; flow:established,from_client; content:"GET"; http_method; content:"/lallyfine/fortniteexternalcheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945585/; classtype:trojan-activity;sid:84808685; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945586)"; flow:established,from_client; content:"GET"; http_method; content:"/dann1hes/warzoneexternalcheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945586/; classtype:trojan-activity;sid:84808686; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945581)"; flow:established,from_client; content:"GET"; http_method; content:"/sharandes/pubg-desync-menu/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945581/; classtype:trojan-activity;sid:84808681; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945580)"; flow:established,from_client; content:"GET"; http_method; content:"/canterls/fivem-external-cheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945580/; classtype:trojan-activity;sid:84808680; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945579)"; flow:established,from_client; content:"GET"; http_method; content:"/h1nkai/fivem-mod-menu-2024/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945579/; classtype:trojan-activity;sid:84808679; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945578)"; flow:established,from_client; content:"GET"; http_method; content:"/stan1kll/fivem-mod-menu/head/loader.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945578/; classtype:trojan-activity;sid:84808678; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945577)"; flow:established,from_client; content:"GET"; http_method; content:"/atease50/redengine-fivem/-/raw/main/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945577/; classtype:trojan-activity;sid:84808677; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945576)"; flow:established,from_client; content:"GET"; http_method; content:"/frezzetag/monotone-hwid-spoofer/-/raw/main/monotone-hwid-spoofer-master.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945576/; classtype:trojan-activity;sid:84808676; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945574)"; flow:established,from_client; content:"GET"; http_method; content:"/elitecall/temp-spoofer-lifetime/-/raw/main/temp-spoofer.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945574/; classtype:trojan-activity;sid:84808674; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945575)"; flow:established,from_client; content:"GET"; http_method; content:"/madchris/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945575/; classtype:trojan-activity;sid:84808675; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945570)"; flow:established,from_client; content:"GET"; http_method; content:"/millycage/fivem-mod-menu/-/raw/main/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945570/; classtype:trojan-activity;sid:84808670; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945571)"; flow:established,from_client; content:"GET"; http_method; content:"/thiefbest/fivem-tz-project/-/raw/main/tz_project.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945571/; classtype:trojan-activity;sid:84808671; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945572)"; flow:established,from_client; content:"GET"; http_method; content:"/assicter/xeno-executor/head/xeno.exe"; http_uri; depth:37; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945572/; classtype:trojan-activity;sid:84808672; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945573)"; flow:established,from_client; content:"GET"; http_method; content:"/d3xxth/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945573/; classtype:trojan-activity;sid:84808673; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945568)"; flow:established,from_client; content:"GET"; http_method; content:"/nightdillar/fivem-spoofer/-/raw/main/fivemspoofer.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945568/; classtype:trojan-activity;sid:84808668; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945569)"; flow:established,from_client; content:"GET"; http_method; content:"/ghosttowns/fivem-spoofer/-/raw/main/fivemspoofer.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945569/; classtype:trojan-activity;sid:84808669; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945567)"; flow:established,from_client; content:"GET"; http_method; content:"/taccherl1s/fivem-external-cheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945567/; classtype:trojan-activity;sid:84808667; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945564)"; flow:established,from_client; content:"GET"; http_method; content:"/badbunnyss/xeno-executor/-/raw/main/xenoexecutor.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945564/; classtype:trojan-activity;sid:84808664; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945565)"; flow:established,from_client; content:"GET"; http_method; content:"/thatways/redengine-fivem/-/raw/main/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945565/; classtype:trojan-activity;sid:84808665; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945566)"; flow:established,from_client; content:"GET"; http_method; content:"/arrivalray/fortnite-ragdoll-v2-privcheat-including-softaim-esp-wallhack-triggerbot-and-more/-/raw/main/loader.exe"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945566/; classtype:trojan-activity;sid:84808666; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945562)"; flow:established,from_client; content:"GET"; http_method; content:"/l1okeey/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945562/; classtype:trojan-activity;sid:84808662; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945563)"; flow:established,from_client; content:"GET"; http_method; content:"/hellnights/skriptgg/-/raw/main/skriptgg.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945563/; classtype:trojan-activity;sid:84808663; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945561)"; flow:established,from_client; content:"GET"; http_method; content:"/lazzerris/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945561/; classtype:trojan-activity;sid:84808661; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945560)"; flow:established,from_client; content:"GET"; http_method; content:"/claydring/monotone-hwid-spoofer/-/raw/main/monotone-hwid-spoofer-master.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945560/; classtype:trojan-activity;sid:84808660; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945559)"; flow:established,from_client; content:"GET"; http_method; content:"/fivemhub/redengine-fivem/-/raw/main/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945559/; classtype:trojan-activity;sid:84808659; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945558)"; flow:established,from_client; content:"GET"; http_method; content:"/kingvolts/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945558/; classtype:trojan-activity;sid:84808658; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945557)"; flow:established,from_client; content:"GET"; http_method; content:"/mikealonsy/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945557/; classtype:trojan-activity;sid:84808657; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945553)"; flow:established,from_client; content:"GET"; http_method; content:"/annellyfray/xeno-executor/-/raw/main/xenoexecutor.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945553/; classtype:trojan-activity;sid:84808653; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945554)"; flow:established,from_client; content:"GET"; http_method; content:"/aw3rall/fivem-mod-menu/head/loader.exe"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945554/; classtype:trojan-activity;sid:84808654; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945555)"; flow:established,from_client; content:"GET"; http_method; content:"/scelmm1/pubg-desync-menu/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945555/; classtype:trojan-activity;sid:84808655; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945556)"; flow:established,from_client; content:"GET"; http_method; content:"/darksocietys/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945556/; classtype:trojan-activity;sid:84808656; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945549)"; flow:established,from_client; content:"GET"; http_method; content:"/princedre/fortnite-ragdoll-v2-privcheat-including-softaim-esp-wallhack-triggerbot-and-more/-/raw/main/loader.exe"; http_uri; depth:113; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945549/; classtype:trojan-activity;sid:84808649; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945550)"; flow:established,from_client; content:"GET"; http_method; content:"/terehota/xeno-executor/-/raw/main/xenoexecutorsetup.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945550/; classtype:trojan-activity;sid:84808650; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945551)"; flow:established,from_client; content:"GET"; http_method; content:"/catboyss/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945551/; classtype:trojan-activity;sid:84808651; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945552)"; flow:established,from_client; content:"GET"; http_method; content:"/jeffhood/fortnitespoofer/-/raw/main/fortnitespoofer.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945552/; classtype:trojan-activity;sid:84808652; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945548)"; flow:established,from_client; content:"GET"; http_method; content:"/limmerbrowd/pubg-desync-menu/head/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945548/; classtype:trojan-activity;sid:84808648; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945545)"; flow:established,from_client; content:"GET"; http_method; content:"/cerrtyhs/roblox-macro-v3.0.0/head/spencer%20macro%20client.exe"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945545/; classtype:trojan-activity;sid:84808645; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945546)"; flow:established,from_client; content:"GET"; http_method; content:"/citizendope/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945546/; classtype:trojan-activity;sid:84808646; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945547)"; flow:established,from_client; content:"GET"; http_method; content:"/rawspeed/fivem-spoofer/-/raw/main/fivemspoofer.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945547/; classtype:trojan-activity;sid:84808647; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945544)"; flow:established,from_client; content:"GET"; http_method; content:"/etherlines/warzone-dominator/head/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945544/; classtype:trojan-activity;sid:84808644; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945543)"; flow:established,from_client; content:"GET"; http_method; content:"/hlefmill/akebi-gc/head/akebi-gc.exe"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945543/; classtype:trojan-activity;sid:84808643; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945541)"; flow:established,from_client; content:"GET"; http_method; content:"/slo1nks/roblox-macro-v3.0.0/head/spencer%20macro%20client.exe"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945541/; classtype:trojan-activity;sid:84808641; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945542)"; flow:established,from_client; content:"GET"; http_method; content:"/an1eers/redengine-fivem/head/loader.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945542/; classtype:trojan-activity;sid:84808642; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945539)"; flow:established,from_client; content:"GET"; http_method; content:"/adennaly/fivem-external-cheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945539/; classtype:trojan-activity;sid:84808639; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945540)"; flow:established,from_client; content:"GET"; http_method; content:"/carterlowd/fivem-tz-project/-/raw/main/tz_project.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945540/; classtype:trojan-activity;sid:84808640; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945536)"; flow:established,from_client; content:"GET"; http_method; content:"/hanalteryy/fortniteexternalcheat/head/loader.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945536/; classtype:trojan-activity;sid:84808636; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945537)"; flow:established,from_client; content:"GET"; http_method; content:"/kevingatess/redengine-fivem/-/raw/main/loader.exe"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945537/; classtype:trojan-activity;sid:84808637; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945538)"; flow:established,from_client; content:"GET"; http_method; content:"/tiffanyprod/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945538/; classtype:trojan-activity;sid:84808638; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945534)"; flow:established,from_client; content:"GET"; http_method; content:"/calleron/fivem-mod-menu/head/loader.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945534/; classtype:trojan-activity;sid:84808634; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945535)"; flow:established,from_client; content:"GET"; http_method; content:"/dannyrockets/fivem-external-cheat/-/raw/main/loader.exe"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945535/; classtype:trojan-activity;sid:84808635; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945533)"; flow:established,from_client; content:"GET"; http_method; content:"/porudsy/pubg-desync-menu/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945533/; classtype:trojan-activity;sid:84808633; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945530)"; flow:established,from_client; content:"GET"; http_method; content:"/mysterris/fortniteexternalcheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945530/; classtype:trojan-activity;sid:84808630; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945531)"; flow:established,from_client; content:"GET"; http_method; content:"/sverrds/c2panel/head/c2panel.exe"; http_uri; depth:33; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945531/; classtype:trojan-activity;sid:84808631; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945532)"; flow:established,from_client; content:"GET"; http_method; content:"/arkillx/redengine-fivem/head/loader.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945532/; classtype:trojan-activity;sid:84808632; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945528)"; flow:established,from_client; content:"GET"; http_method; content:"/emberclub/fluxus-executor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945528/; classtype:trojan-activity;sid:84808628; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945529)"; flow:established,from_client; content:"GET"; http_method; content:"/munuless/fivem-external-cheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945529/; classtype:trojan-activity;sid:84808629; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945527)"; flow:established,from_client; content:"GET"; http_method; content:"/vagggs/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945527/; classtype:trojan-activity;sid:84808627; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945526)"; flow:established,from_client; content:"GET"; http_method; content:"/handwheel/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945526/; classtype:trojan-activity;sid:84808626; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945525)"; flow:established,from_client; content:"GET"; http_method; content:"/nexx1cross/xeno-executor/head/xeno.exe"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945525/; classtype:trojan-activity;sid:84808625; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945522)"; flow:established,from_client; content:"GET"; http_method; content:"/s1neer/fivem-external-cheat/head/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945522/; classtype:trojan-activity;sid:84808622; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945523)"; flow:established,from_client; content:"GET"; http_method; content:"/lenssyw/stalcraft-wh-chams-speedhack-fb/head/prg.rar"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945523/; classtype:trojan-activity;sid:84808623; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945524)"; flow:established,from_client; content:"GET"; http_method; content:"/seantejj/akebi-gc/head/akebi-gc.exe"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945524/; classtype:trojan-activity;sid:84808624; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945520)"; flow:established,from_client; content:"GET"; http_method; content:"/colleras/redengine-fivem/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945520/; classtype:trojan-activity;sid:84808620; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945521)"; flow:established,from_client; content:"GET"; http_method; content:"/callygaes/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945521/; classtype:trojan-activity;sid:84808621; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945518)"; flow:established,from_client; content:"GET"; http_method; content:"/lordesflax/xeno-executor/-/raw/main/xenoexecutor.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945518/; classtype:trojan-activity;sid:84808618; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945519)"; flow:established,from_client; content:"GET"; http_method; content:"/painyclay/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945519/; classtype:trojan-activity;sid:84808619; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945515)"; flow:established,from_client; content:"GET"; http_method; content:"/theftruin/fluxus-executor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945515/; classtype:trojan-activity;sid:84808615; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945516)"; flow:established,from_client; content:"GET"; http_method; content:"/legendstudio/valorantexternalcheat/-/raw/main/loader.exe"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945516/; classtype:trojan-activity;sid:84808616; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945517)"; flow:established,from_client; content:"GET"; http_method; content:"/devileight/valorantexternalcheat/-/raw/main/loader.exe"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945517/; classtype:trojan-activity;sid:84808617; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945513)"; flow:established,from_client; content:"GET"; http_method; content:"/mandyplug/xeno-executor/head/xeno.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945513/; classtype:trojan-activity;sid:84808613; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945514)"; flow:established,from_client; content:"GET"; http_method; content:"/l3monn4k/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945514/; classtype:trojan-activity;sid:84808614; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945509)"; flow:established,from_client; content:"GET"; http_method; content:"/soulier.jeje30/fivem-external-cheat/-/raw/main/license.dll"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945509/; classtype:trojan-activity;sid:84808609; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945510)"; flow:established,from_client; content:"GET"; http_method; content:"/hexxycally/code/-/raw/main/s8d70ipcznaa.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945510/; classtype:trojan-activity;sid:84808610; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945511)"; flow:established,from_client; content:"GET"; http_method; content:"/crazytowns/fortnitespoofer/-/raw/main/fortnitespoofer.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945511/; classtype:trojan-activity;sid:84808611; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945512)"; flow:established,from_client; content:"GET"; http_method; content:"/jazzybless/fivem-external-cheat/-/raw/main/loader.exe"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945512/; classtype:trojan-activity;sid:84808612; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945506)"; flow:established,from_client; content:"GET"; http_method; content:"/nylmak/valorantexternalcheats/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945506/; classtype:trojan-activity;sid:84808606; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945507)"; flow:established,from_client; content:"GET"; http_method; content:"/huntlife/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945507/; classtype:trojan-activity;sid:84808607; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945508)"; flow:established,from_client; content:"GET"; http_method; content:"/revvan1l/pubg-desync-menu/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945508/; classtype:trojan-activity;sid:84808608; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945505)"; flow:established,from_client; content:"GET"; http_method; content:"/jayzhood/fivem-spoofer/head/cfxbypass.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945505/; classtype:trojan-activity;sid:84808605; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945504)"; flow:established,from_client; content:"GET"; http_method; content:"/starkciss/fortniteexternalcheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945504/; classtype:trojan-activity;sid:84808604; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945503)"; flow:established,from_client; content:"GET"; http_method; content:"/lev1de/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945503/; classtype:trojan-activity;sid:84808603; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945501)"; flow:established,from_client; content:"GET"; http_method; content:"/avenncerch/warzone-dominator/head/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945501/; classtype:trojan-activity;sid:84808601; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945502)"; flow:established,from_client; content:"GET"; http_method; content:"/jayloves/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945502/; classtype:trojan-activity;sid:84808602; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945500)"; flow:established,from_client; content:"GET"; http_method; content:"/on1leey/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945500/; classtype:trojan-activity;sid:84808600; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945498)"; flow:established,from_client; content:"GET"; http_method; content:"/liarays/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:113; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945498/; classtype:trojan-activity;sid:84808598; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945499)"; flow:established,from_client; content:"GET"; http_method; content:"/hoodelite/fivem-mod-menu/-/raw/main/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945499/; classtype:trojan-activity;sid:84808599; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945496)"; flow:established,from_client; content:"GET"; http_method; content:"/twistycup/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945496/; classtype:trojan-activity;sid:84808596; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945497)"; flow:established,from_client; content:"GET"; http_method; content:"/farrenths/swift-executor/head/swift.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945497/; classtype:trojan-activity;sid:84808597; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945494)"; flow:established,from_client; content:"GET"; http_method; content:"/bhuvi1430/roblox-macro-v3.0.0/head/language/roblo-macr-1.6.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945494/; classtype:trojan-activity;sid:84808594; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945495)"; flow:established,from_client; content:"GET"; http_method; content:"/myl1tthsw/fortniteexternalcheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945495/; classtype:trojan-activity;sid:84808595; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945492)"; flow:established,from_client; content:"GET"; http_method; content:"/skinnydex/fortnite-ragdoll-v2-privcheat-including-softaim-esp-wallhack-triggerbot-and-more/-/raw/main/loader.exe"; http_uri; depth:113; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945492/; classtype:trojan-activity;sid:84808592; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945493)"; flow:established,from_client; content:"GET"; http_method; content:"/rockystars/fivem-external-cheat-24740/-/raw/main/loader.exe"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945493/; classtype:trojan-activity;sid:84808593; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945490)"; flow:established,from_client; content:"GET"; http_method; content:"/clarityfloat/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:118; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945490/; classtype:trojan-activity;sid:84808590; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945491)"; flow:established,from_client; content:"GET"; http_method; content:"/avra1ls/c2panel/head/c2panel.exe"; http_uri; depth:33; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945491/; classtype:trojan-activity;sid:84808591; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945487)"; flow:established,from_client; content:"GET"; http_method; content:"/ciddur9/pubg-desync-menu/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945487/; classtype:trojan-activity;sid:84808587; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945488)"; flow:established,from_client; content:"GET"; http_method; content:"/kly1assv/warzoneexternalcheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945488/; classtype:trojan-activity;sid:84808588; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945489)"; flow:established,from_client; content:"GET"; http_method; content:"/amalihs/quantv-sp-fivem-ragemp-altv/head/_uninstall/quantv_uninstall.exe"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945489/; classtype:trojan-activity;sid:84808589; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945486)"; flow:established,from_client; content:"GET"; http_method; content:"/mlw3ees/phoenixc2/head/phoenixc2.exe"; http_uri; depth:37; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945486/; classtype:trojan-activity;sid:84808586; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945483)"; flow:established,from_client; content:"GET"; http_method; content:"/gennagds/warzone-dominator/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945483/; classtype:trojan-activity;sid:84808583; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945484)"; flow:established,from_client; content:"GET"; http_method; content:"/landeliur/fivem-spoofer/head/cfxbypass.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945484/; classtype:trojan-activity;sid:84808584; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945485)"; flow:established,from_client; content:"GET"; http_method; content:"/th1nnye/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945485/; classtype:trojan-activity;sid:84808585; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945481)"; flow:established,from_client; content:"GET"; http_method; content:"/amiryblack/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945481/; classtype:trojan-activity;sid:84808581; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945482)"; flow:established,from_client; content:"GET"; http_method; content:"/notescalm/redengine-fivem/-/raw/main/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945482/; classtype:trojan-activity;sid:84808582; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945480)"; flow:established,from_client; content:"GET"; http_method; content:"/lordfall/warzoneexternalcheat-33149/-/raw/main/loader.exe"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945480/; classtype:trojan-activity;sid:84808580; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945477)"; flow:established,from_client; content:"GET"; http_method; content:"/dillarone/xeno-executor/-/raw/main/xenoexecutor.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945477/; classtype:trojan-activity;sid:84808577; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945478)"; flow:established,from_client; content:"GET"; http_method; content:"/himmles/fivem-mod-menu-2024/head/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945478/; classtype:trojan-activity;sid:84808578; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945479)"; flow:established,from_client; content:"GET"; http_method; content:"/khanessal/valorantexternalcheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945479/; classtype:trojan-activity;sid:84808579; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945472)"; flow:established,from_client; content:"GET"; http_method; content:"/fierl1eh/warzoneexternalcheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945472/; classtype:trojan-activity;sid:84808572; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945473)"; flow:established,from_client; content:"GET"; http_method; content:"/drakeremble/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945473/; classtype:trojan-activity;sid:84808573; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945474)"; flow:established,from_client; content:"GET"; http_method; content:"/ameriathing/fortnite-ragdoll-v2-privcheat-including-softaim-esp-wallhack-triggerbot-and-more/-/raw/main/loader.exe"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945474/; classtype:trojan-activity;sid:84808574; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945475)"; flow:established,from_client; content:"GET"; http_method; content:"/dustway/skriptgg/-/raw/main/skriptgg.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945475/; classtype:trojan-activity;sid:84808575; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945476)"; flow:established,from_client; content:"GET"; http_method; content:"/airland-tech/pubg-desync-menu/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945476/; classtype:trojan-activity;sid:84808576; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945471)"; flow:established,from_client; content:"GET"; http_method; content:"/lollypops/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945471/; classtype:trojan-activity;sid:84808571; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945469)"; flow:established,from_client; content:"GET"; http_method; content:"/maclayout/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945469/; classtype:trojan-activity;sid:84808569; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945470)"; flow:established,from_client; content:"GET"; http_method; content:"/painkillers/redengine-fivem/-/raw/main/loader.exe"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945470/; classtype:trojan-activity;sid:84808570; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945467)"; flow:established,from_client; content:"GET"; http_method; content:"/stepbystep-mod/warzone-dominator/head/loader.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945467/; classtype:trojan-activity;sid:84808567; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945468)"; flow:established,from_client; content:"GET"; http_method; content:"/harmss9/fluxus-roblox-executor/head/fluxus%20v7.exe"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945468/; classtype:trojan-activity;sid:84808568; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945466)"; flow:established,from_client; content:"GET"; http_method; content:"/happynights/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945466/; classtype:trojan-activity;sid:84808566; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945463)"; flow:established,from_client; content:"GET"; http_method; content:"/manchstrike/warzone-dominator/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945463/; classtype:trojan-activity;sid:84808563; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945464)"; flow:established,from_client; content:"GET"; http_method; content:"/oceanhurt/fivem-tz-project/-/raw/main/tz_project.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945464/; classtype:trojan-activity;sid:84808564; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945465)"; flow:established,from_client; content:"GET"; http_method; content:"/h0llyest/fivem-tz-project/-/raw/main/tz_project.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945465/; classtype:trojan-activity;sid:84808565; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945462)"; flow:established,from_client; content:"GET"; http_method; content:"/jmenolls/pubg-desync-menu/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945462/; classtype:trojan-activity;sid:84808562; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945460)"; flow:established,from_client; content:"GET"; http_method; content:"/wavedevs/wave-executor/-/raw/main/waveexecutor.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945460/; classtype:trojan-activity;sid:84808560; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945461)"; flow:established,from_client; content:"GET"; http_method; content:"/linthouss/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945461/; classtype:trojan-activity;sid:84808561; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945459)"; flow:established,from_client; content:"GET"; http_method; content:"/frankystorm/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945459/; classtype:trojan-activity;sid:84808559; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945457)"; flow:established,from_client; content:"GET"; http_method; content:"/robinbatman/xeno-executor/-/raw/main/xenoexecutor.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945457/; classtype:trojan-activity;sid:84808557; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945458)"; flow:established,from_client; content:"GET"; http_method; content:"/rayblazes/fivem-spoofer/-/raw/main/fivemspoofer.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945458/; classtype:trojan-activity;sid:84808558; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945454)"; flow:established,from_client; content:"GET"; http_method; content:"/clayforce/fortnitespoofer/-/raw/main/fortnitespoofer.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945454/; classtype:trojan-activity;sid:84808554; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945455)"; flow:established,from_client; content:"GET"; http_method; content:"/lifecouges/fivem-mod-menu/-/raw/main/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945455/; classtype:trojan-activity;sid:84808555; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945456)"; flow:established,from_client; content:"GET"; http_method; content:"/smilecats/fivem-mod-menu/-/raw/main/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945456/; classtype:trojan-activity;sid:84808556; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945452)"; flow:established,from_client; content:"GET"; http_method; content:"/h1elssind/warzoneexternalcheat/head/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945452/; classtype:trojan-activity;sid:84808552; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945453)"; flow:established,from_client; content:"GET"; http_method; content:"/marlyuw/fortniteexternalcheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945453/; classtype:trojan-activity;sid:84808553; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945450)"; flow:established,from_client; content:"GET"; http_method; content:"/claudycode/silentum-spoofer/-/raw/main/silentumspoofer.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945450/; classtype:trojan-activity;sid:84808550; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945451)"; flow:established,from_client; content:"GET"; http_method; content:"/slimlife/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945451/; classtype:trojan-activity;sid:84808551; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945446)"; flow:established,from_client; content:"GET"; http_method; content:"/clatthys/eulencheats-fivem/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945446/; classtype:trojan-activity;sid:84808546; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945447)"; flow:established,from_client; content:"GET"; http_method; content:"/ys3ngd/warzoneexternalcheat/head/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945447/; classtype:trojan-activity;sid:84808547; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945448)"; flow:established,from_client; content:"GET"; http_method; content:"/comptess/exodus-larp-tool/head/exodus.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945448/; classtype:trojan-activity;sid:84808548; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945449)"; flow:established,from_client; content:"GET"; http_method; content:"/anniselth/fivem-mod-menu/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945449/; classtype:trojan-activity;sid:84808549; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945442)"; flow:established,from_client; content:"GET"; http_method; content:"/hannerlys/swift-executor/head/swift.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945442/; classtype:trojan-activity;sid:84808542; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945443)"; flow:established,from_client; content:"GET"; http_method; content:"/bloodout/fivem-external-cheat/-/raw/main/loader.exe"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945443/; classtype:trojan-activity;sid:84808543; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945444)"; flow:established,from_client; content:"GET"; http_method; content:"/lordfall/warzoneexternalcheat-50955/-/raw/main/loader.exe"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945444/; classtype:trojan-activity;sid:84808544; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945445)"; flow:established,from_client; content:"GET"; http_method; content:"/lordfall/warzoneexternalcheat-20461/-/raw/main/loader.exe"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945445/; classtype:trojan-activity;sid:84808545; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945438)"; flow:established,from_client; content:"GET"; http_method; content:"/letter1s/warzone-dominator/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945438/; classtype:trojan-activity;sid:84808538; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945439)"; flow:established,from_client; content:"GET"; http_method; content:"/hinnelyclair/fluxusexecutor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945439/; classtype:trojan-activity;sid:84808539; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945440)"; flow:established,from_client; content:"GET"; http_method; content:"/youngdolp/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945440/; classtype:trojan-activity;sid:84808540; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945441)"; flow:established,from_client; content:"GET"; http_method; content:"/lildemons/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945441/; classtype:trojan-activity;sid:84808541; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945437)"; flow:established,from_client; content:"GET"; http_method; content:"/claymiss/skriptgg/head/skriptgg.exe"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945437/; classtype:trojan-activity;sid:84808537; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945436)"; flow:established,from_client; content:"GET"; http_method; content:"/cashenes/fivem-external-cheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945436/; classtype:trojan-activity;sid:84808536; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945435)"; flow:established,from_client; content:"GET"; http_method; content:"/squezzeflip/fluxus-executor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945435/; classtype:trojan-activity;sid:84808535; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945432)"; flow:established,from_client; content:"GET"; http_method; content:"/icegang/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945432/; classtype:trojan-activity;sid:84808532; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945433)"; flow:established,from_client; content:"GET"; http_method; content:"/idprotxd3n/akebi-gc/head/akebi-gc.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945433/; classtype:trojan-activity;sid:84808533; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945434)"; flow:established,from_client; content:"GET"; http_method; content:"/directorcat/fivem-tz-project/-/raw/main/tz_project.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945434/; classtype:trojan-activity;sid:84808534; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945431)"; flow:established,from_client; content:"GET"; http_method; content:"/blackmatchs/skriptgg/-/raw/main/skriptgg.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945431/; classtype:trojan-activity;sid:84808531; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945429)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddemess/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945429/; classtype:trojan-activity;sid:84808529; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945430)"; flow:established,from_client; content:"GET"; http_method; content:"/captelios/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945430/; classtype:trojan-activity;sid:84808530; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945427)"; flow:established,from_client; content:"GET"; http_method; content:"/merlisshawk/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945427/; classtype:trojan-activity;sid:84808527; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945428)"; flow:established,from_client; content:"GET"; http_method; content:"/tillysplit/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945428/; classtype:trojan-activity;sid:84808528; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945426)"; flow:established,from_client; content:"GET"; http_method; content:"/dirreths/warzone-dominator/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945426/; classtype:trojan-activity;sid:84808526; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945421)"; flow:established,from_client; content:"GET"; http_method; content:"/backflyes/fluxus-roblox-executor/head/fluxus%20v7.exe"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945421/; classtype:trojan-activity;sid:84808521; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945422)"; flow:established,from_client; content:"GET"; http_method; content:"/trustnobodys/fivem-spoofer/head/cfxbypass.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945422/; classtype:trojan-activity;sid:84808522; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945423)"; flow:established,from_client; content:"GET"; http_method; content:"/graviesmetal/fivem-tz-project/-/raw/main/tz_project.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945423/; classtype:trojan-activity;sid:84808523; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945424)"; flow:established,from_client; content:"GET"; http_method; content:"/strikerstory/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:118; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945424/; classtype:trojan-activity;sid:84808524; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945425)"; flow:established,from_client; content:"GET"; http_method; content:"/lampaschde/pubg-desync-menu/head/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945425/; classtype:trojan-activity;sid:84808525; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945419)"; flow:established,from_client; content:"GET"; http_method; content:"/gahdess/valorantexternalcheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945419/; classtype:trojan-activity;sid:84808519; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945420)"; flow:established,from_client; content:"GET"; http_method; content:"/ghostmind/monotone-hwid-spoofer/-/raw/main/monotone-hwid-spoofer-master.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945420/; classtype:trojan-activity;sid:84808520; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945417)"; flow:established,from_client; content:"GET"; http_method; content:"/shafterbills/fivem-external-cheat/-/raw/main/loader.exe"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945417/; classtype:trojan-activity;sid:84808517; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945418)"; flow:established,from_client; content:"GET"; http_method; content:"/teaflip/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945418/; classtype:trojan-activity;sid:84808518; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945413)"; flow:established,from_client; content:"GET"; http_method; content:"/rayclemten/fivem-spoofer/-/raw/main/fivemspoofer.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945413/; classtype:trojan-activity;sid:84808513; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945414)"; flow:established,from_client; content:"GET"; http_method; content:"/centralfaint/fortnitespoofer/-/raw/main/fortnitespoofer.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945414/; classtype:trojan-activity;sid:84808514; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945415)"; flow:established,from_client; content:"GET"; http_method; content:"/ri1llays/quantv-sp-fivem-ragemp-altv/head/_uninstall/quantv_uninstall.exe"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945415/; classtype:trojan-activity;sid:84808515; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945416)"; flow:established,from_client; content:"GET"; http_method; content:"/ficctkysky/swift-executor/head/swift.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945416/; classtype:trojan-activity;sid:84808516; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945411)"; flow:established,from_client; content:"GET"; http_method; content:"/risesun/redengine-fivem/-/raw/main/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945411/; classtype:trojan-activity;sid:84808511; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945412)"; flow:established,from_client; content:"GET"; http_method; content:"/hexxycally/code/-/raw/main/stage_2_1.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945412/; classtype:trojan-activity;sid:84808512; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945408)"; flow:established,from_client; content:"GET"; http_method; content:"/j0ssleyw/phoenixc2/head/phoenixc2.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945408/; classtype:trojan-activity;sid:84808508; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945409)"; flow:established,from_client; content:"GET"; http_method; content:"/cl1mats/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945409/; classtype:trojan-activity;sid:84808509; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945410)"; flow:established,from_client; content:"GET"; http_method; content:"/keeponly/xeno-executor/-/raw/main/xenoexecutor.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945410/; classtype:trojan-activity;sid:84808510; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945407)"; flow:established,from_client; content:"GET"; http_method; content:"/charrl3x/pubg-desync-menu/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945407/; classtype:trojan-activity;sid:84808507; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945404)"; flow:established,from_client; content:"GET"; http_method; content:"/dalleryh/warzone-dominator/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945404/; classtype:trojan-activity;sid:84808504; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945405)"; flow:established,from_client; content:"GET"; http_method; content:"/n0winter/gtahaxui/head/gtahaxui.exe"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945405/; classtype:trojan-activity;sid:84808505; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945406)"; flow:established,from_client; content:"GET"; http_method; content:"/sevverna1/phoenixc2/head/phoenixc2.exe"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945406/; classtype:trojan-activity;sid:84808506; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945403)"; flow:established,from_client; content:"GET"; http_method; content:"/cheveyys/fivem-cheat-with-lua-executor-and-dumper/head/loader.exe"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945403/; classtype:trojan-activity;sid:84808503; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945399)"; flow:established,from_client; content:"GET"; http_method; content:"/butterflys/skriptgg/-/raw/main/skriptgg.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945399/; classtype:trojan-activity;sid:84808499; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945400)"; flow:established,from_client; content:"GET"; http_method; content:"/acrhmasst/xeno-executor/head/xeno.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945400/; classtype:trojan-activity;sid:84808500; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945401)"; flow:established,from_client; content:"GET"; http_method; content:"/resculles/skriptgg/head/skriptgg.exe"; http_uri; depth:37; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945401/; classtype:trojan-activity;sid:84808501; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945402)"; flow:established,from_client; content:"GET"; http_method; content:"/tessh/fluxus-executor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945402/; classtype:trojan-activity;sid:84808502; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945393)"; flow:established,from_client; content:"GET"; http_method; content:"/amillysh/stalcraft-wh-chams-speedhack-fb/head/prg.rar"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945393/; classtype:trojan-activity;sid:84808493; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945394)"; flow:established,from_client; content:"GET"; http_method; content:"/tracerev/silentum-spoofer/-/raw/main/silentumspoofer.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945394/; classtype:trojan-activity;sid:84808494; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945395)"; flow:established,from_client; content:"GET"; http_method; content:"/icedown/fivem-external-cheat/-/raw/main/loader.exe"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945395/; classtype:trojan-activity;sid:84808495; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945396)"; flow:established,from_client; content:"GET"; http_method; content:"/n1kkye/pubg-desync-menu/head/loader.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945396/; classtype:trojan-activity;sid:84808496; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945397)"; flow:established,from_client; content:"GET"; http_method; content:"/luckystarss/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945397/; classtype:trojan-activity;sid:84808497; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945398)"; flow:established,from_client; content:"GET"; http_method; content:"/enns1ial/warzoneexternalcheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945398/; classtype:trojan-activity;sid:84808498; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945390)"; flow:established,from_client; content:"GET"; http_method; content:"/jonnychevsy/valorantexternalcheat/head/loader.exe"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945390/; classtype:trojan-activity;sid:84808490; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945391)"; flow:established,from_client; content:"GET"; http_method; content:"/claysky/eulencheats-fivem/-/raw/main/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945391/; classtype:trojan-activity;sid:84808491; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945392)"; flow:established,from_client; content:"GET"; http_method; content:"/nestlight/fivem-cheat-with-lua-executor-and-dumper/head/loader.exe"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945392/; classtype:trojan-activity;sid:84808492; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945389)"; flow:established,from_client; content:"GET"; http_method; content:"/l3nn1sd/c2panel/head/c2panel.exe"; http_uri; depth:33; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945389/; classtype:trojan-activity;sid:84808489; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945388)"; flow:established,from_client; content:"GET"; http_method; content:"/gamesources/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945388/; classtype:trojan-activity;sid:84808488; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945387)"; flow:established,from_client; content:"GET"; http_method; content:"/spazerock/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945387/; classtype:trojan-activity;sid:84808487; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945386)"; flow:established,from_client; content:"GET"; http_method; content:"/cardegsol/redengine-fivem/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945386/; classtype:trojan-activity;sid:84808486; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945384)"; flow:established,from_client; content:"GET"; http_method; content:"/daveride/skriptgg/-/raw/main/skriptgg.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945384/; classtype:trojan-activity;sid:84808484; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945385)"; flow:established,from_client; content:"GET"; http_method; content:"/kidrockys/genshin-impact-private-cheat-with-spoofer/-/raw/main/akebigc.exe"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945385/; classtype:trojan-activity;sid:84808485; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945382)"; flow:established,from_client; content:"GET"; http_method; content:"/welrshaa/fivem-mod-menu/head/loader.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945382/; classtype:trojan-activity;sid:84808482; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945383)"; flow:established,from_client; content:"GET"; http_method; content:"/terrl1nd/phoenixc2/head/phoenixc2.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945383/; classtype:trojan-activity;sid:84808483; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945379)"; flow:established,from_client; content:"GET"; http_method; content:"/shanneksy/xeno-executor/head/xeno.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945379/; classtype:trojan-activity;sid:84808479; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945380)"; flow:established,from_client; content:"GET"; http_method; content:"/chammerly/warzone-dominator/head/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945380/; classtype:trojan-activity;sid:84808480; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945381)"; flow:established,from_client; content:"GET"; http_method; content:"/lightrecord/fortnite-ragdoll-v2-privcheat-including-softaim-esp-wallhack-triggerbot-and-more/-/raw/main/loader.exe"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945381/; classtype:trojan-activity;sid:84808481; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945378)"; flow:established,from_client; content:"GET"; http_method; content:"/lrth1/akebi-gc/head/akebi-gc.exe"; http_uri; depth:33; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945378/; classtype:trojan-activity;sid:84808478; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945376)"; flow:established,from_client; content:"GET"; http_method; content:"/rockyjones/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:116; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945376/; classtype:trojan-activity;sid:84808476; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945377)"; flow:established,from_client; content:"GET"; http_method; content:"/nissmirld/skriptgg/head/skriptgg.exe"; http_uri; depth:37; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945377/; classtype:trojan-activity;sid:84808477; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945374)"; flow:established,from_client; content:"GET"; http_method; content:"/astrovip/fivem-spoofer/head/cfxbypass.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945374/; classtype:trojan-activity;sid:84808474; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945375)"; flow:established,from_client; content:"GET"; http_method; content:"/slydream/fivem-mod-menu/-/raw/main/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945375/; classtype:trojan-activity;sid:84808475; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945373)"; flow:established,from_client; content:"GET"; http_method; content:"/luxislands/skriptgg/head/skriptgg.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945373/; classtype:trojan-activity;sid:84808473; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945370)"; flow:established,from_client; content:"GET"; http_method; content:"/rainydayss/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945370/; classtype:trojan-activity;sid:84808470; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945371)"; flow:established,from_client; content:"GET"; http_method; content:"/robloxmod/xeno-executor/-/raw/main/xenoexecutor.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945371/; classtype:trojan-activity;sid:84808471; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945372)"; flow:established,from_client; content:"GET"; http_method; content:"/jimmyshots/redengine-fivem/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945372/; classtype:trojan-activity;sid:84808472; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945367)"; flow:established,from_client; content:"GET"; http_method; content:"/tellsofy/fivem-external-cheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945367/; classtype:trojan-activity;sid:84808467; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945368)"; flow:established,from_client; content:"GET"; http_method; content:"/aamersctr/pubg-desync-menu/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945368/; classtype:trojan-activity;sid:84808468; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945369)"; flow:established,from_client; content:"GET"; http_method; content:"/feelsprings/stalcraft-wh-chams-speedhack-fb/head/prg.rar"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945369/; classtype:trojan-activity;sid:84808469; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945365)"; flow:established,from_client; content:"GET"; http_method; content:"/rgbcity/fluxus-executor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945365/; classtype:trojan-activity;sid:84808465; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945366)"; flow:established,from_client; content:"GET"; http_method; content:"/cmehrys/fivem-external-cheat/head/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945366/; classtype:trojan-activity;sid:84808466; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945364)"; flow:established,from_client; content:"GET"; http_method; content:"/linnychers/valorantexternalcheat/head/loader.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945364/; classtype:trojan-activity;sid:84808464; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945363)"; flow:established,from_client; content:"GET"; http_method; content:"/honcymad/warzone-dominator/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945363/; classtype:trojan-activity;sid:84808463; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945362)"; flow:established,from_client; content:"GET"; http_method; content:"/stinnyjones/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945362/; classtype:trojan-activity;sid:84808462; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945360)"; flow:established,from_client; content:"GET"; http_method; content:"/graymid/tinnylieh/-/raw/main/clean4213.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945360/; classtype:trojan-activity;sid:84808460; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945361)"; flow:established,from_client; content:"GET"; http_method; content:"/kannychers/vision-rage-fortnite-privatecheat/head/loader.exe"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945361/; classtype:trojan-activity;sid:84808461; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945355)"; flow:established,from_client; content:"GET"; http_method; content:"/annulims/fivem-mod-menu/head/loader.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945355/; classtype:trojan-activity;sid:84808455; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945356)"; flow:established,from_client; content:"GET"; http_method; content:"/longnights/warzoneexternalcheat/-/raw/main/loader.exe"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945356/; classtype:trojan-activity;sid:84808456; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945357)"; flow:established,from_client; content:"GET"; http_method; content:"/call1neus/fivem-cheat-with-lua-executor-and-dumper/head/loader.exe"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945357/; classtype:trojan-activity;sid:84808457; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945358)"; flow:established,from_client; content:"GET"; http_method; content:"/bl3ve/temp-spoofer-lifetime/-/raw/main/temp-spoofer.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945358/; classtype:trojan-activity;sid:84808458; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945359)"; flow:established,from_client; content:"GET"; http_method; content:"/strikkeplugg/fivem-external-cheat/-/raw/main/loader.exe"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945359/; classtype:trojan-activity;sid:84808459; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945354)"; flow:established,from_client; content:"GET"; http_method; content:"/landonsmith/fortnite-ragdoll-v2-privcheat-including-softaim-esp-wallhack-triggerbot-and-more/-/raw/main/loader.exe"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945354/; classtype:trojan-activity;sid:84808454; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945350)"; flow:established,from_client; content:"GET"; http_method; content:"/champebattle/xeno-executor/head/xeno.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945350/; classtype:trojan-activity;sid:84808450; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945351)"; flow:established,from_client; content:"GET"; http_method; content:"/lordfall/warzoneexternalcheat-64627/-/raw/main/loader.exe"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945351/; classtype:trojan-activity;sid:84808451; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945352)"; flow:established,from_client; content:"GET"; http_method; content:"/amm3lr/fivem-external-cheat/head/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945352/; classtype:trojan-activity;sid:84808452; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945353)"; flow:established,from_client; content:"GET"; http_method; content:"/ims9rry/temp-spoofer-lifetime/-/raw/main/temp-spoofer.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945353/; classtype:trojan-activity;sid:84808453; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945347)"; flow:established,from_client; content:"GET"; http_method; content:"/haspower/fluxus-executor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945347/; classtype:trojan-activity;sid:84808447; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945348)"; flow:established,from_client; content:"GET"; http_method; content:"/ammacl/fivem-external-cheat/head/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945348/; classtype:trojan-activity;sid:84808448; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945349)"; flow:established,from_client; content:"GET"; http_method; content:"/fliplovers/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945349/; classtype:trojan-activity;sid:84808449; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945345)"; flow:established,from_client; content:"GET"; http_method; content:"/aniellys/warzone-dominator/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945345/; classtype:trojan-activity;sid:84808445; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945346)"; flow:established,from_client; content:"GET"; http_method; content:"/hjellx/c2panel/head/c2panel.exe"; http_uri; depth:32; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945346/; classtype:trojan-activity;sid:84808446; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945344)"; flow:established,from_client; content:"GET"; http_method; content:"/nalleysh/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945344/; classtype:trojan-activity;sid:84808444; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945342)"; flow:established,from_client; content:"GET"; http_method; content:"/djkhaleds/warzoneexternalcheat/-/raw/main/loader.exe"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945342/; classtype:trojan-activity;sid:84808442; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945343)"; flow:established,from_client; content:"GET"; http_method; content:"/mollyland/fivem-cheat-with-lua-executor-and-dumper/head/loader.exe"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945343/; classtype:trojan-activity;sid:84808443; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945341)"; flow:established,from_client; content:"GET"; http_method; content:"/mylivess/redengine-fivem/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945341/; classtype:trojan-activity;sid:84808441; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945339)"; flow:established,from_client; content:"GET"; http_method; content:"/linwayne0/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945339/; classtype:trojan-activity;sid:84808439; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945340)"; flow:established,from_client; content:"GET"; http_method; content:"/nossiley/swift-executor/head/swift.exe"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945340/; classtype:trojan-activity;sid:84808440; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945338)"; flow:established,from_client; content:"GET"; http_method; content:"/rettlixs/fivem-mod-menu/head/loader.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945338/; classtype:trojan-activity;sid:84808438; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945335)"; flow:established,from_client; content:"GET"; http_method; content:"/icegreens/genshin-impact-private-cheat-with-spoofer/-/raw/main/akebigc.exe"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945335/; classtype:trojan-activity;sid:84808435; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945336)"; flow:established,from_client; content:"GET"; http_method; content:"/flawshot/silentum-spoofer/-/raw/main/silentumspoofer.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945336/; classtype:trojan-activity;sid:84808436; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945337)"; flow:established,from_client; content:"GET"; http_method; content:"/therr1iel/skriptgg/head/skriptgg.exe"; http_uri; depth:37; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945337/; classtype:trojan-activity;sid:84808437; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945332)"; flow:established,from_client; content:"GET"; http_method; content:"/milltpros/xeno-executor/head/xeno.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945332/; classtype:trojan-activity;sid:84808432; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945333)"; flow:established,from_client; content:"GET"; http_method; content:"/aiwwane/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945333/; classtype:trojan-activity;sid:84808433; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945334)"; flow:established,from_client; content:"GET"; http_method; content:"/kirkydevvy/rezo-gen/head/rezogen.exe"; http_uri; depth:37; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945334/; classtype:trojan-activity;sid:84808434; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945328)"; flow:established,from_client; content:"GET"; http_method; content:"/darreouls/pubg-desync-menu/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945328/; classtype:trojan-activity;sid:84808428; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945329)"; flow:established,from_client; content:"GET"; http_method; content:"/moneytalkss/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945329/; classtype:trojan-activity;sid:84808429; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945330)"; flow:established,from_client; content:"GET"; http_method; content:"/flashrun/fivem-tz-project/-/raw/main/tz_project.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945330/; classtype:trojan-activity;sid:84808430; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945331)"; flow:established,from_client; content:"GET"; http_method; content:"/linosterns/warzone-dominator/head/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945331/; classtype:trojan-activity;sid:84808431; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945326)"; flow:established,from_client; content:"GET"; http_method; content:"/angelsaway/fluxus-executor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945326/; classtype:trojan-activity;sid:84808426; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945327)"; flow:established,from_client; content:"GET"; http_method; content:"/lustyniar/fivem-external-cheat/head/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945327/; classtype:trojan-activity;sid:84808427; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945325)"; flow:established,from_client; content:"GET"; http_method; content:"/hellycrap/swift-executor/head/swift.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945325/; classtype:trojan-activity;sid:84808425; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945319)"; flow:established,from_client; content:"GET"; http_method; content:"/twentyfury/eulencheats-fivem/-/raw/main/loader.exe"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945319/; classtype:trojan-activity;sid:84808419; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945320)"; flow:established,from_client; content:"GET"; http_method; content:"/triplehit/xeno-executor/-/raw/main/xenoexecutor.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945320/; classtype:trojan-activity;sid:84808420; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945321)"; flow:established,from_client; content:"GET"; http_method; content:"/easycutes/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945321/; classtype:trojan-activity;sid:84808421; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945322)"; flow:established,from_client; content:"GET"; http_method; content:"/kapp1el/pubg-desync-menu/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945322/; classtype:trojan-activity;sid:84808422; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945323)"; flow:established,from_client; content:"GET"; http_method; content:"/ann1eys/fortniteexternalcheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945323/; classtype:trojan-activity;sid:84808423; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945324)"; flow:established,from_client; content:"GET"; http_method; content:"/brukelly/umbrella-hwid-tool/head/umbrella/umbrella.exe"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945324/; classtype:trojan-activity;sid:84808424; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945318)"; flow:established,from_client; content:"GET"; http_method; content:"/cherrywavess/xeno-executor/-/raw/main/xenoexecutor.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945318/; classtype:trojan-activity;sid:84808418; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945315)"; flow:established,from_client; content:"GET"; http_method; content:"/snairwalve/dma-spoofer/head/dma_spoofer.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945315/; classtype:trojan-activity;sid:84808415; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945316)"; flow:established,from_client; content:"GET"; http_method; content:"/cassyud/roblox-macro-v3.0.0/head/spencer%20macro%20client.exe"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945316/; classtype:trojan-activity;sid:84808416; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945317)"; flow:established,from_client; content:"GET"; http_method; content:"/faithhard/fortnitespoofer/-/raw/main/fortnitespoofer.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945317/; classtype:trojan-activity;sid:84808417; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945312)"; flow:established,from_client; content:"GET"; http_method; content:"/cml3nfod/c2panel/head/c2panel.exe"; http_uri; depth:34; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945312/; classtype:trojan-activity;sid:84808412; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945313)"; flow:established,from_client; content:"GET"; http_method; content:"/1elience/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945313/; classtype:trojan-activity;sid:84808413; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945314)"; flow:established,from_client; content:"GET"; http_method; content:"/ellzios/redengine-fivem/head/loader.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945314/; classtype:trojan-activity;sid:84808414; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945309)"; flow:established,from_client; content:"GET"; http_method; content:"/cutcash/genshin-impact-private-cheat-with-spoofer/-/raw/main/akebigc.exe"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945309/; classtype:trojan-activity;sid:84808409; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945310)"; flow:established,from_client; content:"GET"; http_method; content:"/rockystars/fivem-external-cheat-95704/-/raw/main/loader.exe"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945310/; classtype:trojan-activity;sid:84808410; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945311)"; flow:established,from_client; content:"GET"; http_method; content:"/hhand3lbf/fivem-lua-executor/head/tiagoexecutor.exe"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945311/; classtype:trojan-activity;sid:84808411; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945307)"; flow:established,from_client; content:"GET"; http_method; content:"/lordfall/warzoneexternalcheat-67193/-/raw/main/loader.exe"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945307/; classtype:trojan-activity;sid:84808407; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945308)"; flow:established,from_client; content:"GET"; http_method; content:"/heenl1es/akebi-gc/head/akebi-gc.exe"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945308/; classtype:trojan-activity;sid:84808408; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945306)"; flow:established,from_client; content:"GET"; http_method; content:"/fancykings/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945306/; classtype:trojan-activity;sid:84808406; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945305)"; flow:established,from_client; content:"GET"; http_method; content:"/champgo/warzoneexternalcheat/-/raw/main/loader.exe"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945305/; classtype:trojan-activity;sid:84808405; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945304)"; flow:established,from_client; content:"GET"; http_method; content:"/sophieray/skriptgg/-/raw/main/skriptgg.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945304/; classtype:trojan-activity;sid:84808404; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945301)"; flow:established,from_client; content:"GET"; http_method; content:"/savalge/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945301/; classtype:trojan-activity;sid:84808401; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945302)"; flow:established,from_client; content:"GET"; http_method; content:"/r1achtelld/phoenixc2/head/phoenixc2.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945302/; classtype:trojan-activity;sid:84808402; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945303)"; flow:established,from_client; content:"GET"; http_method; content:"/middlestones/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:118; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945303/; classtype:trojan-activity;sid:84808403; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945299)"; flow:established,from_client; content:"GET"; http_method; content:"/blowswitch/eulencheats-fivem/-/raw/main/loader.exe"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945299/; classtype:trojan-activity;sid:84808399; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945300)"; flow:established,from_client; content:"GET"; http_method; content:"/sverr1nado/fortniteexternalcheat/head/loader.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945300/; classtype:trojan-activity;sid:84808400; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945296)"; flow:established,from_client; content:"GET"; http_method; content:"/silentflash/fluxus-executor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945296/; classtype:trojan-activity;sid:84808396; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945297)"; flow:established,from_client; content:"GET"; http_method; content:"/lettis99/valorantexternalcheat/head/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945297/; classtype:trojan-activity;sid:84808397; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945298)"; flow:established,from_client; content:"GET"; http_method; content:"/thr1llsdn/warzoneexternalcheat/head/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945298/; classtype:trojan-activity;sid:84808398; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945295)"; flow:established,from_client; content:"GET"; http_method; content:"/dr1vgans/warzoneexternalcheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945295/; classtype:trojan-activity;sid:84808395; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945294)"; flow:established,from_client; content:"GET"; http_method; content:"/k.skr/redengine-fivem/-/raw/main/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945294/; classtype:trojan-activity;sid:84808394; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945292)"; flow:established,from_client; content:"GET"; http_method; content:"/lonelydare/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:116; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945292/; classtype:trojan-activity;sid:84808392; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945293)"; flow:established,from_client; content:"GET"; http_method; content:"/ddnslh/phoenixc2/head/phoenixc2.exe"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945293/; classtype:trojan-activity;sid:84808393; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945291)"; flow:established,from_client; content:"GET"; http_method; content:"/intoyous/fivem-external-cheat/-/raw/main/loader.exe"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945291/; classtype:trojan-activity;sid:84808391; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945290)"; flow:established,from_client; content:"GET"; http_method; content:"/m1ssth/fivem-mod-menu/head/loader.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945290/; classtype:trojan-activity;sid:84808390; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945289)"; flow:established,from_client; content:"GET"; http_method; content:"/bitraces/eulencheats-fivem/-/raw/main/loader.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945289/; classtype:trojan-activity;sid:84808389; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945288)"; flow:established,from_client; content:"GET"; http_method; content:"/evill0v3/fluxus-executor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945288/; classtype:trojan-activity;sid:84808388; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945283)"; flow:established,from_client; content:"GET"; http_method; content:"/bajww1y/xeno-executor/-/raw/main/xenoexecutor.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945283/; classtype:trojan-activity;sid:84808383; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945284)"; flow:established,from_client; content:"GET"; http_method; content:"/wh0ammal/c2panel/head/c2panel.exe"; http_uri; depth:34; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945284/; classtype:trojan-activity;sid:84808384; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945285)"; flow:established,from_client; content:"GET"; http_method; content:"/niceones/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945285/; classtype:trojan-activity;sid:84808385; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945286)"; flow:established,from_client; content:"GET"; http_method; content:"/alexsmile/fortnite-ragdoll-v2-privcheat-including-softaim-esp-wallhack-triggerbot-and-more/-/raw/main/loader.exe"; http_uri; depth:113; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945286/; classtype:trojan-activity;sid:84808386; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945287)"; flow:established,from_client; content:"GET"; http_method; content:"/rainshifter/eulencheats-fivem/-/raw/main/loader.exe"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945287/; classtype:trojan-activity;sid:84808387; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945282)"; flow:established,from_client; content:"GET"; http_method; content:"/tenzart/redengine-fivem/head/loader.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945282/; classtype:trojan-activity;sid:84808382; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945281)"; flow:established,from_client; content:"GET"; http_method; content:"/retrenscall3/fivem-mod-menu/head/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945281/; classtype:trojan-activity;sid:84808381; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945279)"; flow:established,from_client; content:"GET"; http_method; content:"/urremad/c2panel/head/c2panel.exe"; http_uri; depth:33; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945279/; classtype:trojan-activity;sid:84808379; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945280)"; flow:established,from_client; content:"GET"; http_method; content:"/flowwers/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945280/; classtype:trojan-activity;sid:84808380; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945278)"; flow:established,from_client; content:"GET"; http_method; content:"/jayfive/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945278/; classtype:trojan-activity;sid:84808378; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945277)"; flow:established,from_client; content:"GET"; http_method; content:"/litdemons/valorantexternalcheat/-/raw/main/loader.exe"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945277/; classtype:trojan-activity;sid:84808377; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945274)"; flow:established,from_client; content:"GET"; http_method; content:"/jaydeethray/skriptgg/-/raw/main/skriptgg.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945274/; classtype:trojan-activity;sid:84808374; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945275)"; flow:established,from_client; content:"GET"; http_method; content:"/fetchmods/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945275/; classtype:trojan-activity;sid:84808375; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945276)"; flow:established,from_client; content:"GET"; http_method; content:"/lordfall/warzoneexternalcheat-83061/-/raw/main/loader.exe"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945276/; classtype:trojan-activity;sid:84808376; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945271)"; flow:established,from_client; content:"GET"; http_method; content:"/sm0vvk1/pubg-desync-menu/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945271/; classtype:trojan-activity;sid:84808371; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945272)"; flow:established,from_client; content:"GET"; http_method; content:"/linodress/fortniteexternalcheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945272/; classtype:trojan-activity;sid:84808372; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945273)"; flow:established,from_client; content:"GET"; http_method; content:"/scratchmirror/warzoneexternalcheat/-/raw/main/loader.exe"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945273/; classtype:trojan-activity;sid:84808373; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945270)"; flow:established,from_client; content:"GET"; http_method; content:"/myrrhys/valorantexternalcheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945270/; classtype:trojan-activity;sid:84808370; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945269)"; flow:established,from_client; content:"GET"; http_method; content:"/bloodytears/fivem-mod-menu/-/raw/main/loader.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945269/; classtype:trojan-activity;sid:84808369; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945268)"; flow:established,from_client; content:"GET"; http_method; content:"/cernayless/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945268/; classtype:trojan-activity;sid:84808368; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945266)"; flow:established,from_client; content:"GET"; http_method; content:"/calccer/pubg-desync-menu/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945266/; classtype:trojan-activity;sid:84808366; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945267)"; flow:established,from_client; content:"GET"; http_method; content:"/carcellis/rezo-gen/head/rezogen.exe"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945267/; classtype:trojan-activity;sid:84808367; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945264)"; flow:established,from_client; content:"GET"; http_method; content:"/clearsun/valorantexternalcheat/-/raw/main/loader.exe"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945264/; classtype:trojan-activity;sid:84808364; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945265)"; flow:established,from_client; content:"GET"; http_method; content:"/youngbuckss/eulencheats-fivem/-/raw/main/loader.exe"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945265/; classtype:trojan-activity;sid:84808365; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945262)"; flow:established,from_client; content:"GET"; http_method; content:"/a1ncreed/pubg-desync-menu/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945262/; classtype:trojan-activity;sid:84808362; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945263)"; flow:established,from_client; content:"GET"; http_method; content:"/scarletty/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945263/; classtype:trojan-activity;sid:84808363; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945260)"; flow:established,from_client; content:"GET"; http_method; content:"/coscosource/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945260/; classtype:trojan-activity;sid:84808360; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945261)"; flow:established,from_client; content:"GET"; http_method; content:"/graymid/tinnylieh/-/raw/main/ex1h7ahs91s.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945261/; classtype:trojan-activity;sid:84808361; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945259)"; flow:established,from_client; content:"GET"; http_method; content:"/m1llashendj/warzoneexternalcheat/head/loader.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945259/; classtype:trojan-activity;sid:84808359; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945258)"; flow:established,from_client; content:"GET"; http_method; content:"/backstreet/fivem-spoofer/-/raw/main/fivemspoofer.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945258/; classtype:trojan-activity;sid:84808358; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945255)"; flow:established,from_client; content:"GET"; http_method; content:"/ninjaboost-hook/fortniteexternalcheat/head/loader.exe"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945255/; classtype:trojan-activity;sid:84808355; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945256)"; flow:established,from_client; content:"GET"; http_method; content:"/derrystone/temp-spoofer-lifetime/-/raw/main/temp-spoofer.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945256/; classtype:trojan-activity;sid:84808356; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945257)"; flow:established,from_client; content:"GET"; http_method; content:"/bennj1m/fluxusexecutor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945257/; classtype:trojan-activity;sid:84808357; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945254)"; flow:established,from_client; content:"GET"; http_method; content:"/mvainauskas801/fivem-mod-menu/-/raw/main/loader.exe"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945254/; classtype:trojan-activity;sid:84808354; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945252)"; flow:established,from_client; content:"GET"; http_method; content:"/br4ko/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945252/; classtype:trojan-activity;sid:84808352; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945253)"; flow:established,from_client; content:"GET"; http_method; content:"/renn1vys/valorantexternalcheat/head/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945253/; classtype:trojan-activity;sid:84808353; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945251)"; flow:established,from_client; content:"GET"; http_method; content:"/coldlights/fortnite-ragdoll-v2-privcheat-including-softaim-esp-wallhack-triggerbot-and-more/-/raw/main/loader.exe"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945251/; classtype:trojan-activity;sid:84808351; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945250)"; flow:established,from_client; content:"GET"; http_method; content:"/robloxstudios/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945250/; classtype:trojan-activity;sid:84808350; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945246)"; flow:established,from_client; content:"GET"; http_method; content:"/harriles/warzone-dominator/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945246/; classtype:trojan-activity;sid:84808346; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945247)"; flow:established,from_client; content:"GET"; http_method; content:"/kassyelims/fivem-spoofer/head/cfxbypass.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945247/; classtype:trojan-activity;sid:84808347; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945248)"; flow:established,from_client; content:"GET"; http_method; content:"/squeezeflow/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945248/; classtype:trojan-activity;sid:84808348; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945249)"; flow:established,from_client; content:"GET"; http_method; content:"/marisgale/fluxus-executor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945249/; classtype:trojan-activity;sid:84808349; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945245)"; flow:established,from_client; content:"GET"; http_method; content:"/2ddros/warzoneexternalcheat/head/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945245/; classtype:trojan-activity;sid:84808345; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945244)"; flow:established,from_client; content:"GET"; http_method; content:"/devantsteff/xeno-executor/-/raw/main/xenoexecutor.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945244/; classtype:trojan-activity;sid:84808344; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945240)"; flow:established,from_client; content:"GET"; http_method; content:"/dantestriker/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:118; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945240/; classtype:trojan-activity;sid:84808340; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945241)"; flow:established,from_client; content:"GET"; http_method; content:"/tiggoshaw/fivem-spoofer/head/cfxbypass.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945241/; classtype:trojan-activity;sid:84808341; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945242)"; flow:established,from_client; content:"GET"; http_method; content:"/addelky/fivem-cheat-with-lua-executor-and-dumper/head/loader.exe"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945242/; classtype:trojan-activity;sid:84808342; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945243)"; flow:established,from_client; content:"GET"; http_method; content:"/assmerty/fortniteexternalcheat/head/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945243/; classtype:trojan-activity;sid:84808343; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945238)"; flow:established,from_client; content:"GET"; http_method; content:"/lonelyspaze/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945238/; classtype:trojan-activity;sid:84808338; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945239)"; flow:established,from_client; content:"GET"; http_method; content:"/calcereeth/fivem-external-cheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945239/; classtype:trojan-activity;sid:84808339; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945235)"; flow:established,from_client; content:"GET"; http_method; content:"/fivemmods/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945235/; classtype:trojan-activity;sid:84808335; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945236)"; flow:established,from_client; content:"GET"; http_method; content:"/r3ssa/fortnitecheatexternal/head/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945236/; classtype:trojan-activity;sid:84808336; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945237)"; flow:established,from_client; content:"GET"; http_method; content:"/sk1ew/c2panel/head/c2panel.exe"; http_uri; depth:31; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945237/; classtype:trojan-activity;sid:84808337; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945231)"; flow:established,from_client; content:"GET"; http_method; content:"/skymindss/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945231/; classtype:trojan-activity;sid:84808331; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945232)"; flow:established,from_client; content:"GET"; http_method; content:"/k1errl/fluxus-executor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945232/; classtype:trojan-activity;sid:84808332; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945233)"; flow:established,from_client; content:"GET"; http_method; content:"/antracctios/dma-spoofer/head/dma_spoofer.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945233/; classtype:trojan-activity;sid:84808333; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945234)"; flow:established,from_client; content:"GET"; http_method; content:"/rivalshub/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945234/; classtype:trojan-activity;sid:84808334; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945229)"; flow:established,from_client; content:"GET"; http_method; content:"/lordfall/warzoneexternalcheat-88824/-/raw/main/loader.exe"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945229/; classtype:trojan-activity;sid:84808329; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945230)"; flow:established,from_client; content:"GET"; http_method; content:"/climmenflora/temp-spoofer-lifetime/-/raw/main/temp-spoofer.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945230/; classtype:trojan-activity;sid:84808330; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945228)"; flow:established,from_client; content:"GET"; http_method; content:"/graymid/tinnylieh/-/raw/main/draft3637.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945228/; classtype:trojan-activity;sid:84808328; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945224)"; flow:established,from_client; content:"GET"; http_method; content:"/derriolst/swift-executor/head/swift.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945224/; classtype:trojan-activity;sid:84808324; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945225)"; flow:established,from_client; content:"GET"; http_method; content:"/shairmes/valorantexternalcheat/head/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945225/; classtype:trojan-activity;sid:84808325; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945226)"; flow:established,from_client; content:"GET"; http_method; content:"/decrepts/stalcraft-wh-chams-speedhack-fb/head/prg.rar"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945226/; classtype:trojan-activity;sid:84808326; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945227)"; flow:established,from_client; content:"GET"; http_method; content:"/seumms/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945227/; classtype:trojan-activity;sid:84808327; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945223)"; flow:established,from_client; content:"GET"; http_method; content:"/cahrlecute/valorantexternalcheat/head/loader.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945223/; classtype:trojan-activity;sid:84808323; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945222)"; flow:established,from_client; content:"GET"; http_method; content:"/treyten/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945222/; classtype:trojan-activity;sid:84808322; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945221)"; flow:established,from_client; content:"GET"; http_method; content:"/ekxstar/pubg-desync-menu/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945221/; classtype:trojan-activity;sid:84808321; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945218)"; flow:established,from_client; content:"GET"; http_method; content:"/mjjd9/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945218/; classtype:trojan-activity;sid:84808318; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945219)"; flow:established,from_client; content:"GET"; http_method; content:"/sheeww09/fortniteexternalcheat/head/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945219/; classtype:trojan-activity;sid:84808319; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945220)"; flow:established,from_client; content:"GET"; http_method; content:"/marrymss/redengine-fivem/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945220/; classtype:trojan-activity;sid:84808320; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945216)"; flow:established,from_client; content:"GET"; http_method; content:"/sanhilldy/temp-spoofer-lifetime/-/raw/main/temp-spoofer.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945216/; classtype:trojan-activity;sid:84808316; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945217)"; flow:established,from_client; content:"GET"; http_method; content:"/srtlen/genshin-impact-private-cheat-with-spoofer/-/raw/main/akebigc.exe"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945217/; classtype:trojan-activity;sid:84808317; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945214)"; flow:established,from_client; content:"GET"; http_method; content:"/n1elcery/fivem-spoofer/head/cfxbypass.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945214/; classtype:trojan-activity;sid:84808314; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945215)"; flow:established,from_client; content:"GET"; http_method; content:"/n0winter/fortnite-ragdoll-v2-privcheat-including-softaim-esp-wallhack-triggerbot-and-more/-/raw/main/loader.exe"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945215/; classtype:trojan-activity;sid:84808315; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945210)"; flow:established,from_client; content:"GET"; http_method; content:"/clapeymeed/fivem-external-cheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945210/; classtype:trojan-activity;sid:84808310; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945211)"; flow:established,from_client; content:"GET"; http_method; content:"/werst1ll/c2panel/head/c2panel.exe"; http_uri; depth:34; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945211/; classtype:trojan-activity;sid:84808311; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945212)"; flow:established,from_client; content:"GET"; http_method; content:"/smokeloud/monotone-hwid-spoofer/-/raw/main/monotone-hwid-spoofer-master.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945212/; classtype:trojan-activity;sid:84808312; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945213)"; flow:established,from_client; content:"GET"; http_method; content:"/hannessybit/fivem-mod-menu/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945213/; classtype:trojan-activity;sid:84808313; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945207)"; flow:established,from_client; content:"GET"; http_method; content:"/coldrunnss/redengine-fivem/-/raw/main/loader.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945207/; classtype:trojan-activity;sid:84808307; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945208)"; flow:established,from_client; content:"GET"; http_method; content:"/shuurens/fortniteexternalcheat/head/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945208/; classtype:trojan-activity;sid:84808308; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945209)"; flow:established,from_client; content:"GET"; http_method; content:"/babyfacess/fivem-tz-project/-/raw/main/tz_project.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945209/; classtype:trojan-activity;sid:84808309; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945206)"; flow:established,from_client; content:"GET"; http_method; content:"/1vaih3l/c2panel/head/c2panel.exe"; http_uri; depth:33; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945206/; classtype:trojan-activity;sid:84808306; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945204)"; flow:established,from_client; content:"GET"; http_method; content:"/hitituo/solara/head/solara%20v3.exe"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945204/; classtype:trojan-activity;sid:84808304; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945205)"; flow:established,from_client; content:"GET"; http_method; content:"/aerostars99/valorantexternalcheat/head/loader.exe"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945205/; classtype:trojan-activity;sid:84808305; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945202)"; flow:established,from_client; content:"GET"; http_method; content:"/draknones/fortniteexternalcheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945202/; classtype:trojan-activity;sid:84808302; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945203)"; flow:established,from_client; content:"GET"; http_method; content:"/h1llffy/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945203/; classtype:trojan-activity;sid:84808303; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945201)"; flow:established,from_client; content:"GET"; http_method; content:"/flawlessss/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945201/; classtype:trojan-activity;sid:84808301; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945199)"; flow:established,from_client; content:"GET"; http_method; content:"/lorrtheway/warzone-dominator/head/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945199/; classtype:trojan-activity;sid:84808299; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945200)"; flow:established,from_client; content:"GET"; http_method; content:"/archilands/fivem-spoofer/-/raw/main/fivemspoofer.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945200/; classtype:trojan-activity;sid:84808300; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945197)"; flow:established,from_client; content:"GET"; http_method; content:"/ghosthell/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945197/; classtype:trojan-activity;sid:84808297; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945198)"; flow:established,from_client; content:"GET"; http_method; content:"/fessepsiol/valorantexternalcheat/head/loader.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945198/; classtype:trojan-activity;sid:84808298; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945195)"; flow:established,from_client; content:"GET"; http_method; content:"/annelyscod/valorantexternalcheat/head/loader.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945195/; classtype:trojan-activity;sid:84808295; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945196)"; flow:established,from_client; content:"GET"; http_method; content:"/clickforce/fivem-tz-project/-/raw/main/tz_project.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945196/; classtype:trojan-activity;sid:84808296; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945192)"; flow:established,from_client; content:"GET"; http_method; content:"/hellafines/redengine-fivem/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945192/; classtype:trojan-activity;sid:84808292; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945193)"; flow:established,from_client; content:"GET"; http_method; content:"/spindarks/temp-spoofer-lifetime/-/raw/main/temp-spoofer.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945193/; classtype:trojan-activity;sid:84808293; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945194)"; flow:established,from_client; content:"GET"; http_method; content:"/dalgfighter/genshin-impact-private-cheat-with-spoofer/-/raw/main/akebigc.exe"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945194/; classtype:trojan-activity;sid:84808294; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945191)"; flow:established,from_client; content:"GET"; http_method; content:"/louisbess/valorantexternalcheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945191/; classtype:trojan-activity;sid:84808291; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945186)"; flow:established,from_client; content:"GET"; http_method; content:"/darkslimes/temp-spoofer-lifetime/-/raw/main/temp-spoofer.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945186/; classtype:trojan-activity;sid:84808286; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945187)"; flow:established,from_client; content:"GET"; http_method; content:"/rinospot/stalcraft-wh-chams-speedhack-fb/head/prg.rar"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945187/; classtype:trojan-activity;sid:84808287; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945188)"; flow:established,from_client; content:"GET"; http_method; content:"/camilessy/xeno-executor/head/xeno.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945188/; classtype:trojan-activity;sid:84808288; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945189)"; flow:established,from_client; content:"GET"; http_method; content:"/breadmakers/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945189/; classtype:trojan-activity;sid:84808289; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945190)"; flow:established,from_client; content:"GET"; http_method; content:"/nellykit/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945190/; classtype:trojan-activity;sid:84808290; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945185)"; flow:established,from_client; content:"GET"; http_method; content:"/lempacch/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945185/; classtype:trojan-activity;sid:84808285; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945184)"; flow:established,from_client; content:"GET"; http_method; content:"/breathloves/fivem-external-cheat/-/raw/main/loader.exe"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945184/; classtype:trojan-activity;sid:84808284; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945182)"; flow:established,from_client; content:"GET"; http_method; content:"/hhl3mm/fivem-mod-menu-2024/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945182/; classtype:trojan-activity;sid:84808282; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945183)"; flow:established,from_client; content:"GET"; http_method; content:"/skannyxprod/xeno-executor/-/raw/main/xenoexecutor.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945183/; classtype:trojan-activity;sid:84808283; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945174)"; flow:established,from_client; content:"GET"; http_method; content:"/windgods/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945174/; classtype:trojan-activity;sid:84808274; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945175)"; flow:established,from_client; content:"GET"; http_method; content:"/lexx1ngs/c2panel/head/phoenixc2.exe"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945175/; classtype:trojan-activity;sid:84808275; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945176)"; flow:established,from_client; content:"GET"; http_method; content:"/littlesbit/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945176/; classtype:trojan-activity;sid:84808276; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945177)"; flow:established,from_client; content:"GET"; http_method; content:"/derrikhawk/fortnitespoofer/-/raw/main/fortnitespoofer.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945177/; classtype:trojan-activity;sid:84808277; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945178)"; flow:established,from_client; content:"GET"; http_method; content:"/tellysmorph/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945178/; classtype:trojan-activity;sid:84808278; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945179)"; flow:established,from_client; content:"GET"; http_method; content:"/hamtyshev/warzone-dominator/head/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945179/; classtype:trojan-activity;sid:84808279; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945180)"; flow:established,from_client; content:"GET"; http_method; content:"/myleoonel/solara/head/solara%20v3.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945180/; classtype:trojan-activity;sid:84808280; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945181)"; flow:established,from_client; content:"GET"; http_method; content:"/pressentg/pubg-desync-menu/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945181/; classtype:trojan-activity;sid:84808281; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945172)"; flow:established,from_client; content:"GET"; http_method; content:"/nellyfeat/eulencheats-fivem/-/raw/main/loader.exe"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945172/; classtype:trojan-activity;sid:84808272; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945173)"; flow:established,from_client; content:"GET"; http_method; content:"/rickspeedin/fluxus-executor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945173/; classtype:trojan-activity;sid:84808273; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945170)"; flow:established,from_client; content:"GET"; http_method; content:"/buggfuture/eulencheats-fivem/-/raw/main/loader.exe"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945170/; classtype:trojan-activity;sid:84808270; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945171)"; flow:established,from_client; content:"GET"; http_method; content:"/reelland/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945171/; classtype:trojan-activity;sid:84808271; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945169)"; flow:established,from_client; content:"GET"; http_method; content:"/bizzybanks/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945169/; classtype:trojan-activity;sid:84808269; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945168)"; flow:established,from_client; content:"GET"; http_method; content:"/fashionkilla/valorantexternalcheat/-/raw/main/loader.exe"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945168/; classtype:trojan-activity;sid:84808268; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945167)"; flow:established,from_client; content:"GET"; http_method; content:"/realwhaff/c2panel/head/c2panel.exe"; http_uri; depth:35; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945167/; classtype:trojan-activity;sid:84808267; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945166)"; flow:established,from_client; content:"GET"; http_method; content:"/blackvaults/temp-spoofer-lifetime/-/raw/main/temp-spoofer.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945166/; classtype:trojan-activity;sid:84808266; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945160)"; flow:established,from_client; content:"GET"; http_method; content:"/nikravery/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945160/; classtype:trojan-activity;sid:84808260; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945161)"; flow:established,from_client; content:"GET"; http_method; content:"/sleekprod/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945161/; classtype:trojan-activity;sid:84808261; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945162)"; flow:established,from_client; content:"GET"; http_method; content:"/marniesally/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945162/; classtype:trojan-activity;sid:84808262; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945163)"; flow:established,from_client; content:"GET"; http_method; content:"/fetterminds/rezo-gen/head/rezogen.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945163/; classtype:trojan-activity;sid:84808263; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945164)"; flow:established,from_client; content:"GET"; http_method; content:"/hexxycally/code/-/raw/main/7m260nmm3nqf.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945164/; classtype:trojan-activity;sid:84808264; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945165)"; flow:established,from_client; content:"GET"; http_method; content:"/zell1ssh/valorantexternalcheat/head/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945165/; classtype:trojan-activity;sid:84808265; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945158)"; flow:established,from_client; content:"GET"; http_method; content:"/christiancartier/monotone-hwid-spoofer/-/raw/main/monotone-hwid-spoofer-master.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945158/; classtype:trojan-activity;sid:84808258; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945159)"; flow:established,from_client; content:"GET"; http_method; content:"/breakingglights/eulencheats-fivem/-/raw/main/loader.exe"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945159/; classtype:trojan-activity;sid:84808259; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945157)"; flow:established,from_client; content:"GET"; http_method; content:"/shilfview/fortniteexternalcheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945157/; classtype:trojan-activity;sid:84808257; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945156)"; flow:established,from_client; content:"GET"; http_method; content:"/1taskl3n/c2panel/head/c2panel.exe"; http_uri; depth:34; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945156/; classtype:trojan-activity;sid:84808256; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945154)"; flow:established,from_client; content:"GET"; http_method; content:"/lilflow/xeno-executor/-/raw/main/xenoexecutor.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945154/; classtype:trojan-activity;sid:84808254; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945155)"; flow:established,from_client; content:"GET"; http_method; content:"/drakeflock/genshin-impact-private-cheat-with-spoofer/-/raw/main/akebigc.exe"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945155/; classtype:trojan-activity;sid:84808255; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945153)"; flow:established,from_client; content:"GET"; http_method; content:"/scarylayout/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945153/; classtype:trojan-activity;sid:84808253; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945152)"; flow:established,from_client; content:"GET"; http_method; content:"/e1nsilver/valorantexternalcheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945152/; classtype:trojan-activity;sid:84808252; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945149)"; flow:established,from_client; content:"GET"; http_method; content:"/loudyskys/fivem-external-cheat/head/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945149/; classtype:trojan-activity;sid:84808249; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945150)"; flow:established,from_client; content:"GET"; http_method; content:"/arrenthc/fivem-external-cheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945150/; classtype:trojan-activity;sid:84808250; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945151)"; flow:established,from_client; content:"GET"; http_method; content:"/kingvonx/redengine-fivem/-/raw/main/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945151/; classtype:trojan-activity;sid:84808251; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945147)"; flow:established,from_client; content:"GET"; http_method; content:"/chylesst/skriptgg/head/skriptgg.exe"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945147/; classtype:trojan-activity;sid:84808247; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945148)"; flow:established,from_client; content:"GET"; http_method; content:"/skannyghost/genshin-impact-private-cheat-with-spoofer/-/raw/main/akebigc.exe"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945148/; classtype:trojan-activity;sid:84808248; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945142)"; flow:established,from_client; content:"GET"; http_method; content:"/rayvintage/valorantexternalcheat/-/raw/main/loader.exe"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945142/; classtype:trojan-activity;sid:84808242; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945143)"; flow:established,from_client; content:"GET"; http_method; content:"/faynelim/skriptgg/head/skriptgg.exe"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945143/; classtype:trojan-activity;sid:84808243; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945144)"; flow:established,from_client; content:"GET"; http_method; content:"/rovermercury/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945144/; classtype:trojan-activity;sid:84808244; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945145)"; flow:established,from_client; content:"GET"; http_method; content:"/l3ahx/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945145/; classtype:trojan-activity;sid:84808245; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945146)"; flow:established,from_client; content:"GET"; http_method; content:"/actiniy/fivem-spoofer/head/main/five_spoofer_v3.7.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945146/; classtype:trojan-activity;sid:84808246; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945140)"; flow:established,from_client; content:"GET"; http_method; content:"/erryshsos/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945140/; classtype:trojan-activity;sid:84808240; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945141)"; flow:established,from_client; content:"GET"; http_method; content:"/collygass/skriptgg/head/skriptgg.exe"; http_uri; depth:37; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945141/; classtype:trojan-activity;sid:84808241; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945136)"; flow:established,from_client; content:"GET"; http_method; content:"/andyfive/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945136/; classtype:trojan-activity;sid:84808236; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945137)"; flow:established,from_client; content:"GET"; http_method; content:"/galbiaawi/galbiaawi-project67/-/raw/main/program.exe"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945137/; classtype:trojan-activity;sid:84808237; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945138)"; flow:established,from_client; content:"GET"; http_method; content:"/streetleaks/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945138/; classtype:trojan-activity;sid:84808238; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945139)"; flow:established,from_client; content:"GET"; http_method; content:"/highwayss/skriptgg/-/raw/main/skriptgg.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945139/; classtype:trojan-activity;sid:84808239; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945135)"; flow:established,from_client; content:"GET"; http_method; content:"/sn1ffworld/valorantexternalcheat/head/loader.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945135/; classtype:trojan-activity;sid:84808235; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945133)"; flow:established,from_client; content:"GET"; http_method; content:"/twistedlex/fivem-spoofer/head/cfxbypass.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945133/; classtype:trojan-activity;sid:84808233; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945134)"; flow:established,from_client; content:"GET"; http_method; content:"/hollyleaks/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:116; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945134/; classtype:trojan-activity;sid:84808234; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945131)"; flow:established,from_client; content:"GET"; http_method; content:"/chanelssbet/valorantexternalcheat/head/loader.exe"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945131/; classtype:trojan-activity;sid:84808231; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945132)"; flow:established,from_client; content:"GET"; http_method; content:"/thehit/fluxus-executor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945132/; classtype:trojan-activity;sid:84808232; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945128)"; flow:established,from_client; content:"GET"; http_method; content:"/luccords/vision-rage-fortnite-privatecheat/head/loader.exe"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945128/; classtype:trojan-activity;sid:84808228; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945129)"; flow:established,from_client; content:"GET"; http_method; content:"/maxdemons/genshin-impact-private-cheat-with-spoofer/-/raw/main/akebigc.exe"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945129/; classtype:trojan-activity;sid:84808229; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945130)"; flow:established,from_client; content:"GET"; http_method; content:"/moderrys/pubg-desync-menu/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945130/; classtype:trojan-activity;sid:84808230; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945125)"; flow:established,from_client; content:"GET"; http_method; content:"/feedmytrikc/fivem-mod-menu/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945125/; classtype:trojan-activity;sid:84808225; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945126)"; flow:established,from_client; content:"GET"; http_method; content:"/incredd1bl/stalcraft-wh-chams-speedhack-fb/head/loader.exe"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945126/; classtype:trojan-activity;sid:84808226; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945127)"; flow:established,from_client; content:"GET"; http_method; content:"/redstewart/silentum-spoofer/-/raw/main/silentumspoofer.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945127/; classtype:trojan-activity;sid:84808227; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945124)"; flow:established,from_client; content:"GET"; http_method; content:"/vangstrong/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945124/; classtype:trojan-activity;sid:84808224; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945122)"; flow:established,from_client; content:"GET"; http_method; content:"/smaddly/warzone-dominator/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945122/; classtype:trojan-activity;sid:84808222; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945123)"; flow:established,from_client; content:"GET"; http_method; content:"/angelsfire/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945123/; classtype:trojan-activity;sid:84808223; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945120)"; flow:established,from_client; content:"GET"; http_method; content:"/mrwollfs/akebi-gc/head/akebi-gc.exe"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945120/; classtype:trojan-activity;sid:84808220; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945121)"; flow:established,from_client; content:"GET"; http_method; content:"/sunshanes/silentum-spoofer/-/raw/main/silentumspoofer.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945121/; classtype:trojan-activity;sid:84808221; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945119)"; flow:established,from_client; content:"GET"; http_method; content:"/claudycodes/dma-spoofer/head/dma_spoofer.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945119/; classtype:trojan-activity;sid:84808219; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945118)"; flow:established,from_client; content:"GET"; http_method; content:"/merrem1/skriptgg/head/skriptgg.exe"; http_uri; depth:35; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945118/; classtype:trojan-activity;sid:84808218; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945117)"; flow:established,from_client; content:"GET"; http_method; content:"/rayn1e/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945117/; classtype:trojan-activity;sid:84808217; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945115)"; flow:established,from_client; content:"GET"; http_method; content:"/eternnh/stalcraft-wh-chams-speedhack-fb/head/prg.rar"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945115/; classtype:trojan-activity;sid:84808215; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945116)"; flow:established,from_client; content:"GET"; http_method; content:"/lexxyn1ght/solara/head/solara%20v3.exe"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945116/; classtype:trojan-activity;sid:84808216; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945113)"; flow:established,from_client; content:"GET"; http_method; content:"/ellamoon/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945113/; classtype:trojan-activity;sid:84808213; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945114)"; flow:established,from_client; content:"GET"; http_method; content:"/earn1ys/solara/head/solara%20v3.exe"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945114/; classtype:trojan-activity;sid:84808214; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945111)"; flow:established,from_client; content:"GET"; http_method; content:"/asm1rall/warzoneexternalcheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945111/; classtype:trojan-activity;sid:84808211; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945112)"; flow:established,from_client; content:"GET"; http_method; content:"/cassieline/redengine-fivem/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945112/; classtype:trojan-activity;sid:84808212; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945108)"; flow:established,from_client; content:"GET"; http_method; content:"/crystalmix/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945108/; classtype:trojan-activity;sid:84808208; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945109)"; flow:established,from_client; content:"GET"; http_method; content:"/shadowmid/fivem-mod-menu/-/raw/main/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945109/; classtype:trojan-activity;sid:84808209; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945110)"; flow:established,from_client; content:"GET"; http_method; content:"/skieesbruh/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945110/; classtype:trojan-activity;sid:84808210; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945106)"; flow:established,from_client; content:"GET"; http_method; content:"/blackeyex/valorantexternalcheat/-/raw/main/loader.exe"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945106/; classtype:trojan-activity;sid:84808206; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945107)"; flow:established,from_client; content:"GET"; http_method; content:"/rachelbenz/skriptgg/-/raw/main/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945107/; classtype:trojan-activity;sid:84808207; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945104)"; flow:established,from_client; content:"GET"; http_method; content:"/millysouls/skriptgg/head/skriptgg.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945104/; classtype:trojan-activity;sid:84808204; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945105)"; flow:established,from_client; content:"GET"; http_method; content:"/creyty1h/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945105/; classtype:trojan-activity;sid:84808205; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945103)"; flow:established,from_client; content:"GET"; http_method; content:"/luckysharp/silentum-spoofer/-/raw/main/silentumspoofer.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945103/; classtype:trojan-activity;sid:84808203; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945102)"; flow:established,from_client; content:"GET"; http_method; content:"/baddlybenz/fortnite-ragdoll-v2-privcheat-including-softaim-esp-wallhack-triggerbot-and-more/-/raw/main/loader.exe"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945102/; classtype:trojan-activity;sid:84808202; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945099)"; flow:established,from_client; content:"GET"; http_method; content:"/einsspel/valorantexternalcheat/head/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945099/; classtype:trojan-activity;sid:84808199; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945100)"; flow:established,from_client; content:"GET"; http_method; content:"/madmaxxxx/silentum-spoofer/-/raw/main/silentumspoofer.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945100/; classtype:trojan-activity;sid:84808200; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945101)"; flow:established,from_client; content:"GET"; http_method; content:"/icespices/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945101/; classtype:trojan-activity;sid:84808201; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945098)"; flow:established,from_client; content:"GET"; http_method; content:"/finnykland/valorantexternalcheat/head/loader.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945098/; classtype:trojan-activity;sid:84808198; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945097)"; flow:established,from_client; content:"GET"; http_method; content:"/levelcaps/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945097/; classtype:trojan-activity;sid:84808197; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945096)"; flow:established,from_client; content:"GET"; http_method; content:"/etherist/xeno-executor/-/raw/main/xenoexecutor.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945096/; classtype:trojan-activity;sid:84808196; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945095)"; flow:established,from_client; content:"GET"; http_method; content:"/rctshasl/c2panel/head/c2panel.exe"; http_uri; depth:34; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945095/; classtype:trojan-activity;sid:84808195; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945093)"; flow:established,from_client; content:"GET"; http_method; content:"/larriedgs/valorantexternalcheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945093/; classtype:trojan-activity;sid:84808193; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945094)"; flow:established,from_client; content:"GET"; http_method; content:"/m1nestakkl/tiago-executor-fivem/head/tiagoexecutor.exe"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945094/; classtype:trojan-activity;sid:84808194; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945092)"; flow:established,from_client; content:"GET"; http_method; content:"/futurebest/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945092/; classtype:trojan-activity;sid:84808192; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945091)"; flow:established,from_client; content:"GET"; http_method; content:"/uterrfly/fivem-external-cheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945091/; classtype:trojan-activity;sid:84808191; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945088)"; flow:established,from_client; content:"GET"; http_method; content:"/paingames/monotone-hwid-spoofer/-/raw/main/monotone-hwid-spoofer-master.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945088/; classtype:trojan-activity;sid:84808188; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945089)"; flow:established,from_client; content:"GET"; http_method; content:"/duoeer/pubg-desync-menu/head/loader.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945089/; classtype:trojan-activity;sid:84808189; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945090)"; flow:established,from_client; content:"GET"; http_method; content:"/hellywayne/redengine-fivem/-/raw/main/loader.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945090/; classtype:trojan-activity;sid:84808190; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945087)"; flow:established,from_client; content:"GET"; http_method; content:"/racktyga/fluxus-executor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945087/; classtype:trojan-activity;sid:84808187; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945086)"; flow:established,from_client; content:"GET"; http_method; content:"/arretx9/eulencheats-fivem/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945086/; classtype:trojan-activity;sid:84808186; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945085)"; flow:established,from_client; content:"GET"; http_method; content:"/darkface/fortnite-ragdoll-v2-privcheat-including-softaim-esp-wallhack-triggerbot-and-more/-/raw/main/loader.exe"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945085/; classtype:trojan-activity;sid:84808185; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945084)"; flow:established,from_client; content:"GET"; http_method; content:"/silencehit/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:116; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945084/; classtype:trojan-activity;sid:84808184; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945082)"; flow:established,from_client; content:"GET"; http_method; content:"/chassmilty/swift-executor/head/swift.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945082/; classtype:trojan-activity;sid:84808182; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945083)"; flow:established,from_client; content:"GET"; http_method; content:"/therapture/valorantexternalcheat/-/raw/main/loader.exe"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945083/; classtype:trojan-activity;sid:84808183; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945081)"; flow:established,from_client; content:"GET"; http_method; content:"/predatts/vision-rage-fortnite-privatecheat/head/loader.exe"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945081/; classtype:trojan-activity;sid:84808181; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945080)"; flow:established,from_client; content:"GET"; http_method; content:"/chammerth/xeno-executor/head/xeno.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945080/; classtype:trojan-activity;sid:84808180; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945078)"; flow:established,from_client; content:"GET"; http_method; content:"/litthersy/warzone-dominator/head/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945078/; classtype:trojan-activity;sid:84808178; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945079)"; flow:established,from_client; content:"GET"; http_method; content:"/beeloves/fortnite-ragdoll-v2-privcheat-including-softaim-esp-wallhack-triggerbot-and-more/-/raw/main/loader.exe"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945079/; classtype:trojan-activity;sid:84808179; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945077)"; flow:established,from_client; content:"GET"; http_method; content:"/cellistin/fivem-mod-menu/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945077/; classtype:trojan-activity;sid:84808177; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945076)"; flow:established,from_client; content:"GET"; http_method; content:"/calliloyars/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945076/; classtype:trojan-activity;sid:84808176; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945075)"; flow:established,from_client; content:"GET"; http_method; content:"/h0fablood/akebi-gc/head/akebi-gc.exe"; http_uri; depth:37; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945075/; classtype:trojan-activity;sid:84808175; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945074)"; flow:established,from_client; content:"GET"; http_method; content:"/looksydillar/skriptgg/head/skriptgg.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945074/; classtype:trojan-activity;sid:84808174; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945073)"; flow:established,from_client; content:"GET"; http_method; content:"/cr1cragss/valorantexternalcheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945073/; classtype:trojan-activity;sid:84808173; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945070)"; flow:established,from_client; content:"GET"; http_method; content:"/krissmind/fortniteexternalcheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945070/; classtype:trojan-activity;sid:84808170; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945071)"; flow:established,from_client; content:"GET"; http_method; content:"/flokkyslide/monotone-hwid-spoofer/-/raw/main/monotone-hwid-spoofer-master.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945071/; classtype:trojan-activity;sid:84808171; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945072)"; flow:established,from_client; content:"GET"; http_method; content:"/skallyer/pubg-desync-menu/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945072/; classtype:trojan-activity;sid:84808172; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945069)"; flow:established,from_client; content:"GET"; http_method; content:"/purellys/warzone-dominator/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945069/; classtype:trojan-activity;sid:84808169; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945067)"; flow:established,from_client; content:"GET"; http_method; content:"/spectreless/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945067/; classtype:trojan-activity;sid:84808167; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945068)"; flow:established,from_client; content:"GET"; http_method; content:"/claimstars/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945068/; classtype:trojan-activity;sid:84808168; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945065)"; flow:established,from_client; content:"GET"; http_method; content:"/bobsimit20/fivem-mod-menu/-/raw/main/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945065/; classtype:trojan-activity;sid:84808165; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945066)"; flow:established,from_client; content:"GET"; http_method; content:"/alisophy/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945066/; classtype:trojan-activity;sid:84808166; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945064)"; flow:established,from_client; content:"GET"; http_method; content:"/flockyblock/genshin-impact-private-cheat-with-spoofer/-/raw/main/akebigc.exe"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945064/; classtype:trojan-activity;sid:84808164; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945060)"; flow:established,from_client; content:"GET"; http_method; content:"/smashcats/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945060/; classtype:trojan-activity;sid:84808160; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945061)"; flow:established,from_client; content:"GET"; http_method; content:"/il3sh3n/fivem-mod-menu-2024/head/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945061/; classtype:trojan-activity;sid:84808161; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945062)"; flow:established,from_client; content:"GET"; http_method; content:"/stehh1l/pubg-desync-menu/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945062/; classtype:trojan-activity;sid:84808162; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945063)"; flow:established,from_client; content:"GET"; http_method; content:"/playoffx/xeno-executor/-/raw/main/xenoexecutor.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945063/; classtype:trojan-activity;sid:84808163; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945057)"; flow:established,from_client; content:"GET"; http_method; content:"/sanzpro5/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945057/; classtype:trojan-activity;sid:84808157; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945058)"; flow:established,from_client; content:"GET"; http_method; content:"/xennyflow/verox-gta-enhanced/head/verox.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945058/; classtype:trojan-activity;sid:84808158; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945059)"; flow:established,from_client; content:"GET"; http_method; content:"/fluxusdeveloper/fluxus-executor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945059/; classtype:trojan-activity;sid:84808159; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945055)"; flow:established,from_client; content:"GET"; http_method; content:"/secidiots/exodus-larp-tool/head/exodus.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945055/; classtype:trojan-activity;sid:84808155; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945056)"; flow:established,from_client; content:"GET"; http_method; content:"/drismad/warzoneexternalcheat/-/raw/main/loader.exe"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945056/; classtype:trojan-activity;sid:84808156; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945053)"; flow:established,from_client; content:"GET"; http_method; content:"/lordfall/warzoneexternalcheat-25933/-/raw/main/loader.exe"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945053/; classtype:trojan-activity;sid:84808153; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945054)"; flow:established,from_client; content:"GET"; http_method; content:"/firebirdss/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945054/; classtype:trojan-activity;sid:84808154; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945051)"; flow:established,from_client; content:"GET"; http_method; content:"/slimthugs/fivem-external-cheat/-/raw/main/loader.exe"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945051/; classtype:trojan-activity;sid:84808151; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945052)"; flow:established,from_client; content:"GET"; http_method; content:"/brandonhillss/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945052/; classtype:trojan-activity;sid:84808152; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945044)"; flow:established,from_client; content:"GET"; http_method; content:"/rockystars/fivem-external-cheat-93119/-/raw/main/loader.exe"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945044/; classtype:trojan-activity;sid:84808144; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945045)"; flow:established,from_client; content:"GET"; http_method; content:"/k1leens/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945045/; classtype:trojan-activity;sid:84808145; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945046)"; flow:established,from_client; content:"GET"; http_method; content:"/ennerlis/fivem-external-cheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945046/; classtype:trojan-activity;sid:84808146; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945047)"; flow:established,from_client; content:"GET"; http_method; content:"/skannyes/skriptgg/head/skriptgg.exe"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945047/; classtype:trojan-activity;sid:84808147; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945048)"; flow:established,from_client; content:"GET"; http_method; content:"/l1eyssh/pubg-desync-menu/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945048/; classtype:trojan-activity;sid:84808148; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945049)"; flow:established,from_client; content:"GET"; http_method; content:"/miderrln/stalcraft-wh-chams-speedhack-fb/head/prg.rar"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945049/; classtype:trojan-activity;sid:84808149; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945050)"; flow:established,from_client; content:"GET"; http_method; content:"/carre1ys/pubg-desync-menu/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945050/; classtype:trojan-activity;sid:84808150; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945040)"; flow:established,from_client; content:"GET"; http_method; content:"/ninestalk/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945040/; classtype:trojan-activity;sid:84808140; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945041)"; flow:established,from_client; content:"GET"; http_method; content:"/disneyworld/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945041/; classtype:trojan-activity;sid:84808141; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945042)"; flow:established,from_client; content:"GET"; http_method; content:"/mrsquezze/silentum-spoofer/-/raw/main/silentumspoofer.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945042/; classtype:trojan-activity;sid:84808142; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945043)"; flow:established,from_client; content:"GET"; http_method; content:"/atthry/roblox-macro-v3.0.0/head/spencer%20macro%20client.exe"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945043/; classtype:trojan-activity;sid:84808143; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945036)"; flow:established,from_client; content:"GET"; http_method; content:"/ahhelsan/phoenixc2/head/phoenixc2.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945036/; classtype:trojan-activity;sid:84808136; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945037)"; flow:established,from_client; content:"GET"; http_method; content:"/darkenclimbs/vision-rage-fortnite-privatecheat/head/loader.exe"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945037/; classtype:trojan-activity;sid:84808137; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945038)"; flow:established,from_client; content:"GET"; http_method; content:"/starlightoke/fivem-mod-menu/head/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945038/; classtype:trojan-activity;sid:84808138; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945039)"; flow:established,from_client; content:"GET"; http_method; content:"/ccctennx/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945039/; classtype:trojan-activity;sid:84808139; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945030)"; flow:established,from_client; content:"GET"; http_method; content:"/breddylee/eulencheats-fivem/head/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945030/; classtype:trojan-activity;sid:84808130; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945031)"; flow:established,from_client; content:"GET"; http_method; content:"/lordfall/warzoneexternalcheat-52619/-/raw/main/loader.exe"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945031/; classtype:trojan-activity;sid:84808131; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945032)"; flow:established,from_client; content:"GET"; http_method; content:"/ashreal/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945032/; classtype:trojan-activity;sid:84808132; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945033)"; flow:established,from_client; content:"GET"; http_method; content:"/dertlandd/warzone-dominator/head/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945033/; classtype:trojan-activity;sid:84808133; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945034)"; flow:established,from_client; content:"GET"; http_method; content:"/callwave/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945034/; classtype:trojan-activity;sid:84808134; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945035)"; flow:established,from_client; content:"GET"; http_method; content:"/nellamoon/fortniteexternalcheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945035/; classtype:trojan-activity;sid:84808135; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945029)"; flow:established,from_client; content:"GET"; http_method; content:"/lordfall/warzoneexternalcheat-73810/-/raw/main/loader.exe"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945029/; classtype:trojan-activity;sid:84808129; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945028)"; flow:established,from_client; content:"GET"; http_method; content:"/panssey/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945028/; classtype:trojan-activity;sid:84808128; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945026)"; flow:established,from_client; content:"GET"; http_method; content:"/celmm1y/fivem-external-cheat/head/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945026/; classtype:trojan-activity;sid:84808126; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945027)"; flow:established,from_client; content:"GET"; http_method; content:"/cocandrei88/fivem-mod-menu/-/raw/main/loader.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945027/; classtype:trojan-activity;sid:84808127; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945024)"; flow:established,from_client; content:"GET"; http_method; content:"/hawkseven/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945024/; classtype:trojan-activity;sid:84808124; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945025)"; flow:established,from_client; content:"GET"; http_method; content:"/urresst/redengine-fivem/head/loader.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945025/; classtype:trojan-activity;sid:84808125; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945023)"; flow:established,from_client; content:"GET"; http_method; content:"/linespectr/fivem-external-cheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945023/; classtype:trojan-activity;sid:84808123; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945022)"; flow:established,from_client; content:"GET"; http_method; content:"/vrhall/c2panel/head/c2panel.exe"; http_uri; depth:32; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945022/; classtype:trojan-activity;sid:84808122; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945021)"; flow:established,from_client; content:"GET"; http_method; content:"/curtyxdev/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945021/; classtype:trojan-activity;sid:84808121; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945020)"; flow:established,from_client; content:"GET"; http_method; content:"/memphisrays/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945020/; classtype:trojan-activity;sid:84808120; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945019)"; flow:established,from_client; content:"GET"; http_method; content:"/tha1lsh/warzoneexternalcheat/head/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945019/; classtype:trojan-activity;sid:84808119; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945018)"; flow:established,from_client; content:"GET"; http_method; content:"/apprechs/fivem-external-cheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945018/; classtype:trojan-activity;sid:84808118; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945017)"; flow:established,from_client; content:"GET"; http_method; content:"/springfieldss/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:119; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945017/; classtype:trojan-activity;sid:84808117; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945011)"; flow:established,from_client; content:"GET"; http_method; content:"/peussh1ng/phoenixc2/head/phoenixc2.exe"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945011/; classtype:trojan-activity;sid:84808111; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945012)"; flow:established,from_client; content:"GET"; http_method; content:"/thousandscreams/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:121; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945012/; classtype:trojan-activity;sid:84808112; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945013)"; flow:established,from_client; content:"GET"; http_method; content:"/screwlyhound/silentum-spoofer/-/raw/main/silentumspoofer.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945013/; classtype:trojan-activity;sid:84808113; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945014)"; flow:established,from_client; content:"GET"; http_method; content:"/rockfeel/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945014/; classtype:trojan-activity;sid:84808114; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945015)"; flow:established,from_client; content:"GET"; http_method; content:"/freeunlocks/fortnitespoofer/-/raw/main/fortnitespoofer.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945015/; classtype:trojan-activity;sid:84808115; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945016)"; flow:established,from_client; content:"GET"; http_method; content:"/lifefour/fivem-mod-menu/-/raw/main/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945016/; classtype:trojan-activity;sid:84808116; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945010)"; flow:established,from_client; content:"GET"; http_method; content:"/reckylessy/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945010/; classtype:trojan-activity;sid:84808110; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945002)"; flow:established,from_client; content:"GET"; http_method; content:"/earltwin/fortnite-ragdoll-v2-privcheat-including-softaim-esp-wallhack-triggerbot-and-more/-/raw/main/loader.exe"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945002/; classtype:trojan-activity;sid:84808102; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945003)"; flow:established,from_client; content:"GET"; http_method; content:"/flashbars/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945003/; classtype:trojan-activity;sid:84808103; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945004)"; flow:established,from_client; content:"GET"; http_method; content:"/cllierys/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945004/; classtype:trojan-activity;sid:84808104; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945005)"; flow:established,from_client; content:"GET"; http_method; content:"/fernniud/fivem-mod-menu/head/loader.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945005/; classtype:trojan-activity;sid:84808105; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945006)"; flow:established,from_client; content:"GET"; http_method; content:"/bleddimurs/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945006/; classtype:trojan-activity;sid:84808106; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945007)"; flow:established,from_client; content:"GET"; http_method; content:"/tk3ssta/akebi-gc/head/akebi-gc.exe"; http_uri; depth:35; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945007/; classtype:trojan-activity;sid:84808107; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945008)"; flow:established,from_client; content:"GET"; http_method; content:"/1nicchel/warzoneexternalcheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945008/; classtype:trojan-activity;sid:84808108; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945009)"; flow:established,from_client; content:"GET"; http_method; content:"/shvvl1n/fivem-mod-menu/head/loader.exe"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945009/; classtype:trojan-activity;sid:84808109; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944996)"; flow:established,from_client; content:"GET"; http_method; content:"/fivelouds/fortniteexternalcheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944996/; classtype:trojan-activity;sid:84808096; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944997)"; flow:established,from_client; content:"GET"; http_method; content:"/thisfeelings/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944997/; classtype:trojan-activity;sid:84808097; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944998)"; flow:established,from_client; content:"GET"; http_method; content:"/sweetsalty/eulencheats-fivem/-/raw/main/loader.exe"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944998/; classtype:trojan-activity;sid:84808098; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944999)"; flow:established,from_client; content:"GET"; http_method; content:"/arrychanel/fivem-external-cheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944999/; classtype:trojan-activity;sid:84808099; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945000)"; flow:established,from_client; content:"GET"; http_method; content:"/levelspoints/warzone-dominator/head/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945000/; classtype:trojan-activity;sid:84808100; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3945001)"; flow:established,from_client; content:"GET"; http_method; content:"/shannyis/fivem-mod-menu/head/loader.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3945001/; classtype:trojan-activity;sid:84808101; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944995)"; flow:established,from_client; content:"GET"; http_method; content:"/tegodives/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944995/; classtype:trojan-activity;sid:84808095; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944994)"; flow:established,from_client; content:"GET"; http_method; content:"/ramdelice/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944994/; classtype:trojan-activity;sid:84808094; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944992)"; flow:established,from_client; content:"GET"; http_method; content:"/lannydays/fivem-external-cheat/head/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944992/; classtype:trojan-activity;sid:84808092; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944993)"; flow:established,from_client; content:"GET"; http_method; content:"/recctan1o/fivem-spoofer/head/cfxbypass.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944993/; classtype:trojan-activity;sid:84808093; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944991)"; flow:established,from_client; content:"GET"; http_method; content:"/ameliajones/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944991/; classtype:trojan-activity;sid:84808091; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944990)"; flow:established,from_client; content:"GET"; http_method; content:"/chileberryt/valorantexternalcheat/head/loader.exe"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944990/; classtype:trojan-activity;sid:84808090; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944989)"; flow:established,from_client; content:"GET"; http_method; content:"/skapples/fivem-mod-menu/head/loader.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944989/; classtype:trojan-activity;sid:84808089; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944986)"; flow:established,from_client; content:"GET"; http_method; content:"/rhaddas/genshin-impact-private-cheat-with-spoofer/-/raw/main/akebigc.exe"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944986/; classtype:trojan-activity;sid:84808086; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944987)"; flow:established,from_client; content:"GET"; http_method; content:"/callensiy/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944987/; classtype:trojan-activity;sid:84808087; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944988)"; flow:established,from_client; content:"GET"; http_method; content:"/accilely/fortniteexternalcheat/head/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944988/; classtype:trojan-activity;sid:84808088; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944984)"; flow:established,from_client; content:"GET"; http_method; content:"/uclets/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944984/; classtype:trojan-activity;sid:84808084; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944985)"; flow:established,from_client; content:"GET"; http_method; content:"/houndblink/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:116; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944985/; classtype:trojan-activity;sid:84808085; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944981)"; flow:established,from_client; content:"GET"; http_method; content:"/h1lfsald/phoenixc2/head/phoenixc2.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944981/; classtype:trojan-activity;sid:84808081; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944982)"; flow:established,from_client; content:"GET"; http_method; content:"/li1aarh/fortniteexternalcheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944982/; classtype:trojan-activity;sid:84808082; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944983)"; flow:established,from_client; content:"GET"; http_method; content:"/unitedstars/eulencheats-fivem/-/raw/main/loader.exe"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944983/; classtype:trojan-activity;sid:84808083; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944979)"; flow:established,from_client; content:"GET"; http_method; content:"/scriptshub/xeno-executor/-/raw/main/xenoexecutor.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944979/; classtype:trojan-activity;sid:84808079; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944980)"; flow:established,from_client; content:"GET"; http_method; content:"/beettherains/pubg-desync-menu/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944980/; classtype:trojan-activity;sid:84808080; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944973)"; flow:established,from_client; content:"GET"; http_method; content:"/amnesiacalmss/fivem-spoofer/-/raw/main/fivemspoofer.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944973/; classtype:trojan-activity;sid:84808073; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944974)"; flow:established,from_client; content:"GET"; http_method; content:"/kaue9919a/fivem-external-cheat/-/raw/main/loader.exe"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944974/; classtype:trojan-activity;sid:84808074; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944975)"; flow:established,from_client; content:"GET"; http_method; content:"/charles998/xeno-executor/-/raw/main/xenoexecutor.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944975/; classtype:trojan-activity;sid:84808075; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944976)"; flow:established,from_client; content:"GET"; http_method; content:"/myehax/c2panel/head/c2panel.exe"; http_uri; depth:32; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944976/; classtype:trojan-activity;sid:84808076; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944977)"; flow:established,from_client; content:"GET"; http_method; content:"/diskej1/fivem-mod-menu/-/raw/main/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944977/; classtype:trojan-activity;sid:84808077; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944978)"; flow:established,from_client; content:"GET"; http_method; content:"/f1llsvy/stalcraft-wh-chams-speedhack-fb/head/prg.rar"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944978/; classtype:trojan-activity;sid:84808078; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944972)"; flow:established,from_client; content:"GET"; http_method; content:"/nahh1ly/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944972/; classtype:trojan-activity;sid:84808072; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944970)"; flow:established,from_client; content:"GET"; http_method; content:"/septhleft/fortniteexternalcheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944970/; classtype:trojan-activity;sid:84808070; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944971)"; flow:established,from_client; content:"GET"; http_method; content:"/achkills/xeno-executor/-/raw/main/xenoexecutor.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944971/; classtype:trojan-activity;sid:84808071; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944968)"; flow:established,from_client; content:"GET"; http_method; content:"/f1nneyx/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944968/; classtype:trojan-activity;sid:84808068; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944969)"; flow:established,from_client; content:"GET"; http_method; content:"/rockystars/fivem-external-cheat-86014/-/raw/main/loader.exe"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944969/; classtype:trojan-activity;sid:84808069; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944967)"; flow:established,from_client; content:"GET"; http_method; content:"/merthsdx/pubg-desync-menu/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944967/; classtype:trojan-activity;sid:84808067; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944966)"; flow:established,from_client; content:"GET"; http_method; content:"/paradiseleaks/fivem-tz-project/-/raw/main/tz_project.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944966/; classtype:trojan-activity;sid:84808066; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944965)"; flow:established,from_client; content:"GET"; http_method; content:"/kaccelir/fivem-external-cheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944965/; classtype:trojan-activity;sid:84808065; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944964)"; flow:established,from_client; content:"GET"; http_method; content:"/sterrels/xeno-executor/head/xeno.exe"; http_uri; depth:37; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944964/; classtype:trojan-activity;sid:84808064; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944959)"; flow:established,from_client; content:"GET"; http_method; content:"/chverr1/warzoneexternalcheat/head/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944959/; classtype:trojan-activity;sid:84808059; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944960)"; flow:established,from_client; content:"GET"; http_method; content:"/ieddl1/eulencheats-fivem/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944960/; classtype:trojan-activity;sid:84808060; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944961)"; flow:established,from_client; content:"GET"; http_method; content:"/changessy/fivem-cheat-with-lua-executor-and-dumper/head/loader.exe"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944961/; classtype:trojan-activity;sid:84808061; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944962)"; flow:established,from_client; content:"GET"; http_method; content:"/m3shad/warzoneexternalcheat/head/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944962/; classtype:trojan-activity;sid:84808062; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944963)"; flow:established,from_client; content:"GET"; http_method; content:"/br1nnasvag3/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944963/; classtype:trojan-activity;sid:84808063; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944956)"; flow:established,from_client; content:"GET"; http_method; content:"/n0nwhy/quantv-sp-fivem-ragemp-altv/head/_uninstall/quantv_uninstall.exe"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944956/; classtype:trojan-activity;sid:84808056; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944957)"; flow:established,from_client; content:"GET"; http_method; content:"/denn1ers/warzone-dominator/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944957/; classtype:trojan-activity;sid:84808057; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944958)"; flow:established,from_client; content:"GET"; http_method; content:"/lovelyfight/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944958/; classtype:trojan-activity;sid:84808058; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944953)"; flow:established,from_client; content:"GET"; http_method; content:"/hollycat/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944953/; classtype:trojan-activity;sid:84808053; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944954)"; flow:established,from_client; content:"GET"; http_method; content:"/bonfiress/skriptgg/-/raw/main/skriptgg.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944954/; classtype:trojan-activity;sid:84808054; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944955)"; flow:established,from_client; content:"GET"; http_method; content:"/linstarbig/fivem-mod-menu/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944955/; classtype:trojan-activity;sid:84808055; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944950)"; flow:established,from_client; content:"GET"; http_method; content:"/dindukes/temp-spoofer-lifetime/-/raw/main/temp-spoofer.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944950/; classtype:trojan-activity;sid:84808050; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944951)"; flow:established,from_client; content:"GET"; http_method; content:"/hollyway/fivem-mod-menu/-/raw/main/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944951/; classtype:trojan-activity;sid:84808051; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944952)"; flow:established,from_client; content:"GET"; http_method; content:"/tierbess/warzone-dominator/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944952/; classtype:trojan-activity;sid:84808052; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944948)"; flow:established,from_client; content:"GET"; http_method; content:"/ccvds/c2panel/head/c2panel.exe"; http_uri; depth:31; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944948/; classtype:trojan-activity;sid:84808048; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944949)"; flow:established,from_client; content:"GET"; http_method; content:"/heavenlees/fortnitespoofer/-/raw/main/fortnitespoofer.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944949/; classtype:trojan-activity;sid:84808049; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944945)"; flow:established,from_client; content:"GET"; http_method; content:"/fckuee/akebi-gc/head/akebi-gc.exe"; http_uri; depth:34; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944945/; classtype:trojan-activity;sid:84808045; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944946)"; flow:established,from_client; content:"GET"; http_method; content:"/graymid/tinnylieh/-/raw/main/l7xh7ur9695u.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944946/; classtype:trojan-activity;sid:84808046; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944947)"; flow:established,from_client; content:"GET"; http_method; content:"/djavvy/valorantexternalcheat/head/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944947/; classtype:trojan-activity;sid:84808047; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944944)"; flow:established,from_client; content:"GET"; http_method; content:"/demonhorses/fivem-spoofer/-/raw/main/fivemspoofer.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944944/; classtype:trojan-activity;sid:84808044; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944943)"; flow:established,from_client; content:"GET"; http_method; content:"/puzzlerdown/fivem-external-cheat/head/loader.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944943/; classtype:trojan-activity;sid:84808043; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944942)"; flow:established,from_client; content:"GET"; http_method; content:"/juellys/fivem-spoofer/head/cfxbypass.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944942/; classtype:trojan-activity;sid:84808042; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944940)"; flow:established,from_client; content:"GET"; http_method; content:"/silvergolds/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944940/; classtype:trojan-activity;sid:84808040; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944941)"; flow:established,from_client; content:"GET"; http_method; content:"/milleges/skriptgg/head/skriptgg.exe"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944941/; classtype:trojan-activity;sid:84808041; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944931)"; flow:established,from_client; content:"GET"; http_method; content:"/jamemood/fivem-cheat-with-lua-executor-and-dumper/head/loader.exe"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944931/; classtype:trojan-activity;sid:84808031; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944932)"; flow:established,from_client; content:"GET"; http_method; content:"/madescape/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944932/; classtype:trojan-activity;sid:84808032; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944933)"; flow:established,from_client; content:"GET"; http_method; content:"/quantvv/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944933/; classtype:trojan-activity;sid:84808033; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944934)"; flow:established,from_client; content:"GET"; http_method; content:"/rayfierh/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944934/; classtype:trojan-activity;sid:84808034; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944935)"; flow:established,from_client; content:"GET"; http_method; content:"/playitrocks/fortniteexternalcheat/head/loader.exe"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944935/; classtype:trojan-activity;sid:84808035; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944936)"; flow:established,from_client; content:"GET"; http_method; content:"/mixteens/fivem-spoofer/head/cfxbypass.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944936/; classtype:trojan-activity;sid:84808036; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944937)"; flow:established,from_client; content:"GET"; http_method; content:"/v1llenth/fivem-spoofer/head/cfxbypass.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944937/; classtype:trojan-activity;sid:84808037; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944938)"; flow:established,from_client; content:"GET"; http_method; content:"/lonnelyduo/warzone-dominator/head/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944938/; classtype:trojan-activity;sid:84808038; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944939)"; flow:established,from_client; content:"GET"; http_method; content:"/cleanwaves/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944939/; classtype:trojan-activity;sid:84808039; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944930)"; flow:established,from_client; content:"GET"; http_method; content:"/rammlesta1/phoenixc2/head/phoenixc2.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944930/; classtype:trojan-activity;sid:84808030; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944927)"; flow:established,from_client; content:"GET"; http_method; content:"/blasthood/genshin-impact-private-cheat-with-spoofer/-/raw/main/akebigc.exe"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944927/; classtype:trojan-activity;sid:84808027; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944928)"; flow:established,from_client; content:"GET"; http_method; content:"/ownsticky/xeno-executor/-/raw/main/xenoexecutor.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944928/; classtype:trojan-activity;sid:84808028; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944929)"; flow:established,from_client; content:"GET"; http_method; content:"/lifesigns/temp-spoofer-lifetime/-/raw/main/temp-spoofer.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944929/; classtype:trojan-activity;sid:84808029; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944926)"; flow:established,from_client; content:"GET"; http_method; content:"/mall1ey/pubg-desync-menu/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944926/; classtype:trojan-activity;sid:84808026; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944925)"; flow:established,from_client; content:"GET"; http_method; content:"/revosplit/fortnitespoofer/-/raw/main/fortnitespoofer.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944925/; classtype:trojan-activity;sid:84808025; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944921)"; flow:established,from_client; content:"GET"; http_method; content:"/aohal3xxn/phoenixc2/head/skriptgg.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944921/; classtype:trojan-activity;sid:84808021; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944922)"; flow:established,from_client; content:"GET"; http_method; content:"/n3llapixel/fivem-external-cheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944922/; classtype:trojan-activity;sid:84808022; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944923)"; flow:established,from_client; content:"GET"; http_method; content:"/genaglouy/vision-rage-fortnite-privatecheat/head/loader.exe"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944923/; classtype:trojan-activity;sid:84808023; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944924)"; flow:established,from_client; content:"GET"; http_method; content:"/isslewwdd/akebigc/head/akebi-gc.exe"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944924/; classtype:trojan-activity;sid:84808024; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944916)"; flow:established,from_client; content:"GET"; http_method; content:"/goldyvip/fivem-mod-menu/-/raw/main/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944916/; classtype:trojan-activity;sid:84808016; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944917)"; flow:established,from_client; content:"GET"; http_method; content:"/starmicht/valorantexternalcheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944917/; classtype:trojan-activity;sid:84808017; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944918)"; flow:established,from_client; content:"GET"; http_method; content:"/roycemind/vision-rage-fortnite-privatecheat/head/loader.exe"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944918/; classtype:trojan-activity;sid:84808018; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944919)"; flow:established,from_client; content:"GET"; http_method; content:"/culturefive/eulencheats-fivem/-/raw/main/loader.exe"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944919/; classtype:trojan-activity;sid:84808019; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944920)"; flow:established,from_client; content:"GET"; http_method; content:"/niessenlars1/fivem-mod-menu/-/raw/main/loader.exe"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944920/; classtype:trojan-activity;sid:84808020; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944915)"; flow:established,from_client; content:"GET"; http_method; content:"/cartersilence/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:119; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944915/; classtype:trojan-activity;sid:84808015; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944913)"; flow:established,from_client; content:"GET"; http_method; content:"/m1sstfire/redengine-fivem/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944913/; classtype:trojan-activity;sid:84808013; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944914)"; flow:established,from_client; content:"GET"; http_method; content:"/limmacouch/fivem-spoofer/head/cfxbypass.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944914/; classtype:trojan-activity;sid:84808014; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944910)"; flow:established,from_client; content:"GET"; http_method; content:"/alwayshigh/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944910/; classtype:trojan-activity;sid:84808010; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944911)"; flow:established,from_client; content:"GET"; http_method; content:"/stakemiss/fortniteexternalcheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944911/; classtype:trojan-activity;sid:84808011; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944912)"; flow:established,from_client; content:"GET"; http_method; content:"/lennysright/warzone-dominator/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944912/; classtype:trojan-activity;sid:84808012; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944909)"; flow:established,from_client; content:"GET"; http_method; content:"/alicejeel/temp-spoofer-lifetime/-/raw/main/temp-spoofer.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944909/; classtype:trojan-activity;sid:84808009; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944908)"; flow:established,from_client; content:"GET"; http_method; content:"/skyll1/hwid-spoofer-hwid-changer-bioguard/head/resethwid.exe"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944908/; classtype:trojan-activity;sid:84808008; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944905)"; flow:established,from_client; content:"GET"; http_method; content:"/linsqueeze/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944905/; classtype:trojan-activity;sid:84808005; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944906)"; flow:established,from_client; content:"GET"; http_method; content:"/edd1nes/verox-gta-enhanced/head/verox.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944906/; classtype:trojan-activity;sid:84808006; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944907)"; flow:established,from_client; content:"GET"; http_method; content:"/pinkslips/fivem-mod-menu/-/raw/main/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944907/; classtype:trojan-activity;sid:84808007; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944904)"; flow:established,from_client; content:"GET"; http_method; content:"/passlemr/valorantexternalcheat/head/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944904/; classtype:trojan-activity;sid:84808004; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944899)"; flow:established,from_client; content:"GET"; http_method; content:"/rockystars/fivem-external-cheat-47785/-/raw/main/loader.exe"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944899/; classtype:trojan-activity;sid:84807999; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944900)"; flow:established,from_client; content:"GET"; http_method; content:"/xillendy/vision-rage-fortnite-privatecheat/head/loader.exe"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944900/; classtype:trojan-activity;sid:84808000; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944901)"; flow:established,from_client; content:"GET"; http_method; content:"/mo1vs/fivem-external-cheat/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944901/; classtype:trojan-activity;sid:84808001; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944902)"; flow:established,from_client; content:"GET"; http_method; content:"/hexxycally/code/-/raw/main/e4j3q5825i7f.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944902/; classtype:trojan-activity;sid:84808002; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944903)"; flow:established,from_client; content:"GET"; http_method; content:"/a2z51/hwid-spoofer/-/raw/main/universalspoofer.exe"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944903/; classtype:trojan-activity;sid:84808003; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944898)"; flow:established,from_client; content:"GET"; http_method; content:"/drglitchs/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944898/; classtype:trojan-activity;sid:84807998; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944895)"; flow:established,from_client; content:"GET"; http_method; content:"/ostflord/fivem-mod-menu/head/loader.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944895/; classtype:trojan-activity;sid:84807995; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944896)"; flow:established,from_client; content:"GET"; http_method; content:"/graymid/tinnylieh/-/raw/main/s8d70ipcznaa.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944896/; classtype:trojan-activity;sid:84807996; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944897)"; flow:established,from_client; content:"GET"; http_method; content:"/raydelt/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:113; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944897/; classtype:trojan-activity;sid:84807997; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944891)"; flow:established,from_client; content:"GET"; http_method; content:"/deebillz/fivem-mod-menu/-/raw/main/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944891/; classtype:trojan-activity;sid:84807991; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944892)"; flow:established,from_client; content:"GET"; http_method; content:"/l3ossh1/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944892/; classtype:trojan-activity;sid:84807992; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944893)"; flow:established,from_client; content:"GET"; http_method; content:"/candyliss/fortniteexternalcheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944893/; classtype:trojan-activity;sid:84807993; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944894)"; flow:established,from_client; content:"GET"; http_method; content:"/nelsonah7/fivem-mod-menu/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944894/; classtype:trojan-activity;sid:84807994; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944888)"; flow:established,from_client; content:"GET"; http_method; content:"/rockystars/fivem-external-cheat-92975/-/raw/main/loader.exe"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944888/; classtype:trojan-activity;sid:84807988; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944889)"; flow:established,from_client; content:"GET"; http_method; content:"/barrhp1na/fortniteexternalcheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944889/; classtype:trojan-activity;sid:84807989; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944890)"; flow:established,from_client; content:"GET"; http_method; content:"/therelax/genshin-impact-private-cheat-with-spoofer/-/raw/main/akebigc.exe"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944890/; classtype:trojan-activity;sid:84807990; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944887)"; flow:established,from_client; content:"GET"; http_method; content:"/dallymells/redengine-fivem/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944887/; classtype:trojan-activity;sid:84807987; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944885)"; flow:established,from_client; content:"GET"; http_method; content:"/dailymurr/valorantexternalcheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944885/; classtype:trojan-activity;sid:84807985; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944886)"; flow:established,from_client; content:"GET"; http_method; content:"/raffelsas/redengine-fivem/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944886/; classtype:trojan-activity;sid:84807986; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944884)"; flow:established,from_client; content:"GET"; http_method; content:"/clarittes/warzone-dominator/head/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944884/; classtype:trojan-activity;sid:84807984; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944881)"; flow:established,from_client; content:"GET"; http_method; content:"/dailyscripts132/eulencheats-fivem/-/raw/main/loader.exe"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944881/; classtype:trojan-activity;sid:84807981; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944882)"; flow:established,from_client; content:"GET"; http_method; content:"/facc1erhan/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944882/; classtype:trojan-activity;sid:84807982; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944883)"; flow:established,from_client; content:"GET"; http_method; content:"/f0lkssvg/stalcraft-wh-chams-speedhack-fb/head/prg.rar"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944883/; classtype:trojan-activity;sid:84807983; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944879)"; flow:established,from_client; content:"GET"; http_method; content:"/hexxycally/code/-/raw/main/stage2.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944879/; classtype:trojan-activity;sid:84807979; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944880)"; flow:established,from_client; content:"GET"; http_method; content:"/airshade/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944880/; classtype:trojan-activity;sid:84807980; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944878)"; flow:established,from_client; content:"GET"; http_method; content:"/dashspeed/valorantexternalcheat/-/raw/main/loader.exe"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944878/; classtype:trojan-activity;sid:84807978; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944877)"; flow:established,from_client; content:"GET"; http_method; content:"/blacklines/valorantexternalcheat/-/raw/main/loader.exe"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944877/; classtype:trojan-activity;sid:84807977; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944873)"; flow:established,from_client; content:"GET"; http_method; content:"/elipsydoll/valorantexternalcheat/head/loader.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944873/; classtype:trojan-activity;sid:84807973; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944874)"; flow:established,from_client; content:"GET"; http_method; content:"/lovelylifes/rezo-gen/head/rezogen.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944874/; classtype:trojan-activity;sid:84807974; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944875)"; flow:established,from_client; content:"GET"; http_method; content:"/jettls/warzone-dominator/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944875/; classtype:trojan-activity;sid:84807975; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944876)"; flow:established,from_client; content:"GET"; http_method; content:"/deviatfax/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944876/; classtype:trojan-activity;sid:84807976; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944872)"; flow:established,from_client; content:"GET"; http_method; content:"/d4rkzyz12/fivem-mod-menu/-/raw/main/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944872/; classtype:trojan-activity;sid:84807972; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944868)"; flow:established,from_client; content:"GET"; http_method; content:"/novacarths/warzone-dominator/head/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944868/; classtype:trojan-activity;sid:84807968; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944869)"; flow:established,from_client; content:"GET"; http_method; content:"/intergta5/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944869/; classtype:trojan-activity;sid:84807969; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944870)"; flow:established,from_client; content:"GET"; http_method; content:"/radiantleaks/quantv-sp-fivem-ragemp-altv/-/raw/main/quantv_latest_2026.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944870/; classtype:trojan-activity;sid:84807970; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944871)"; flow:established,from_client; content:"GET"; http_method; content:"/rockystars/fivem-external-cheat-20492/-/raw/main/loader.exe"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944871/; classtype:trojan-activity;sid:84807971; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944867)"; flow:established,from_client; content:"GET"; http_method; content:"/l1nnsy/warzone-dominator/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944867/; classtype:trojan-activity;sid:84807967; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944862)"; flow:established,from_client; content:"GET"; http_method; content:"/metroboomin/valorantexternalcheat/-/raw/main/loader.exe"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944862/; classtype:trojan-activity;sid:84807962; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944863)"; flow:established,from_client; content:"GET"; http_method; content:"/accleron/fivem-external-cheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944863/; classtype:trojan-activity;sid:84807963; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944864)"; flow:established,from_client; content:"GET"; http_method; content:"/sandloj/warzoneexternalcheat/head/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944864/; classtype:trojan-activity;sid:84807964; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944865)"; flow:established,from_client; content:"GET"; http_method; content:"/nellybenz/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944865/; classtype:trojan-activity;sid:84807965; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944866)"; flow:established,from_client; content:"GET"; http_method; content:"/redfieldsy/valorantexternalcheat/head/loader.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944866/; classtype:trojan-activity;sid:84807966; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944859)"; flow:established,from_client; content:"GET"; http_method; content:"/rockystars/fivem-external-cheat-67465/-/raw/main/loader.exe"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944859/; classtype:trojan-activity;sid:84807959; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944860)"; flow:established,from_client; content:"GET"; http_method; content:"/tifannyblessed/fivem-mod-menu/-/raw/main/loader.exe"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944860/; classtype:trojan-activity;sid:84807960; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944861)"; flow:established,from_client; content:"GET"; http_method; content:"/millyshake/monotone-hwid-spoofer/-/raw/main/monotone-hwid-spoofer-master.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944861/; classtype:trojan-activity;sid:84807961; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944858)"; flow:established,from_client; content:"GET"; http_method; content:"/humblecap/fivem-spoofer/-/raw/main/fivemspoofer.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944858/; classtype:trojan-activity;sid:84807958; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944857)"; flow:established,from_client; content:"GET"; http_method; content:"/add1nales/c2panel/head/c2panel.exe"; http_uri; depth:35; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944857/; classtype:trojan-activity;sid:84807957; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944854)"; flow:established,from_client; content:"GET"; http_method; content:"/n1tchess/quantv-sp-fivem-ragemp-altv/head/_uninstall/quantv_uninstall.exe"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944854/; classtype:trojan-activity;sid:84807954; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944855)"; flow:established,from_client; content:"GET"; http_method; content:"/rollouts/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944855/; classtype:trojan-activity;sid:84807955; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944856)"; flow:established,from_client; content:"GET"; http_method; content:"/ghostways/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944856/; classtype:trojan-activity;sid:84807956; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944852)"; flow:established,from_client; content:"GET"; http_method; content:"/kayflock/redengine-fivem/-/raw/main/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944852/; classtype:trojan-activity;sid:84807952; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944853)"; flow:established,from_client; content:"GET"; http_method; content:"/derregy/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944853/; classtype:trojan-activity;sid:84807953; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944851)"; flow:established,from_client; content:"GET"; http_method; content:"/earlieyd/fortniteexternalcheat/head/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944851/; classtype:trojan-activity;sid:84807951; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944850)"; flow:established,from_client; content:"GET"; http_method; content:"/hlesnw2/phoenixc2/head/phoenixc2.exe"; http_uri; depth:37; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944850/; classtype:trojan-activity;sid:84807950; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944847)"; flow:established,from_client; content:"GET"; http_method; content:"/l1nnemurr/valorantexternalcheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944847/; classtype:trojan-activity;sid:84807947; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944848)"; flow:established,from_client; content:"GET"; http_method; content:"/oerrlis/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944848/; classtype:trojan-activity;sid:84807948; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944849)"; flow:established,from_client; content:"GET"; http_method; content:"/l1sstwe/stalcraft-wh-chams-speedhack-fb/head/prg.rar"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944849/; classtype:trojan-activity;sid:84807949; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944845)"; flow:established,from_client; content:"GET"; http_method; content:"/kenzoball/genshin-impact-private-cheat-with-spoofer/-/raw/main/akebigc.exe"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944845/; classtype:trojan-activity;sid:84807945; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944846)"; flow:established,from_client; content:"GET"; http_method; content:"/khanddjo/fluxusexecutor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944846/; classtype:trojan-activity;sid:84807946; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944843)"; flow:established,from_client; content:"GET"; http_method; content:"/raccley/stalcraft-wh-chams-speedhack-fb/head/prg.rar"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944843/; classtype:trojan-activity;sid:84807943; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944844)"; flow:established,from_client; content:"GET"; http_method; content:"/durkframe/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944844/; classtype:trojan-activity;sid:84807944; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944840)"; flow:established,from_client; content:"GET"; http_method; content:"/lindycat/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944840/; classtype:trojan-activity;sid:84807940; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944841)"; flow:established,from_client; content:"GET"; http_method; content:"/reelssticks/redengine-fivem/head/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944841/; classtype:trojan-activity;sid:84807941; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944842)"; flow:established,from_client; content:"GET"; http_method; content:"/rhymesroy/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944842/; classtype:trojan-activity;sid:84807942; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944839)"; flow:established,from_client; content:"GET"; http_method; content:"/lordfall/warzoneexternalcheat-67664/-/raw/main/loader.exe"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944839/; classtype:trojan-activity;sid:84807939; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944838)"; flow:established,from_client; content:"GET"; http_method; content:"/lancycath/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944838/; classtype:trojan-activity;sid:84807938; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944835)"; flow:established,from_client; content:"GET"; http_method; content:"/beatog/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944835/; classtype:trojan-activity;sid:84807935; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944836)"; flow:established,from_client; content:"GET"; http_method; content:"/slyboogy/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944836/; classtype:trojan-activity;sid:84807936; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944837)"; flow:established,from_client; content:"GET"; http_method; content:"/terrysblack/warzone-dominator/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944837/; classtype:trojan-activity;sid:84807937; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944834)"; flow:established,from_client; content:"GET"; http_method; content:"/astroworlds/valorantexternalcheat/-/raw/main/loader.exe"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944834/; classtype:trojan-activity;sid:84807934; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944830)"; flow:established,from_client; content:"GET"; http_method; content:"/rockystars/fivem-external-cheat/-/raw/main/loader.exe"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944830/; classtype:trojan-activity;sid:84807930; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944831)"; flow:established,from_client; content:"GET"; http_method; content:"/hollycap/fortnite-ragdoll-v2-privcheat-including-softaim-esp-wallhack-triggerbot-and-more/-/raw/main/loader.exe"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944831/; classtype:trojan-activity;sid:84807931; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944832)"; flow:established,from_client; content:"GET"; http_method; content:"/lesperrd/fivem-external-cheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944832/; classtype:trojan-activity;sid:84807932; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944833)"; flow:established,from_client; content:"GET"; http_method; content:"/ci1ents9/swift-executor/head/swift.exe"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944833/; classtype:trojan-activity;sid:84807933; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944829)"; flow:established,from_client; content:"GET"; http_method; content:"/niyssol/pubg-desync-menu/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944829/; classtype:trojan-activity;sid:84807929; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944826)"; flow:established,from_client; content:"GET"; http_method; content:"/louierule/genshin-impact-private-cheat-with-spoofer/-/raw/main/akebigc.exe"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944826/; classtype:trojan-activity;sid:84807926; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944827)"; flow:established,from_client; content:"GET"; http_method; content:"/leftyou/fivem-tz-project/-/raw/main/tz_project.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944827/; classtype:trojan-activity;sid:84807927; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944828)"; flow:established,from_client; content:"GET"; http_method; content:"/rootnexty/skriptgg/head/skriptgg.exe"; http_uri; depth:37; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944828/; classtype:trojan-activity;sid:84807928; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944824)"; flow:established,from_client; content:"GET"; http_method; content:"/middlesavage/warzone-dominator/head/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944824/; classtype:trojan-activity;sid:84807924; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944825)"; flow:established,from_client; content:"GET"; http_method; content:"/swennhr/skriptgg/head/skriptgg.exe"; http_uri; depth:35; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944825/; classtype:trojan-activity;sid:84807925; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944822)"; flow:established,from_client; content:"GET"; http_method; content:"/fettywapss/fortnite-ragdoll-v2-privcheat-including-softaim-esp-wallhack-triggerbot-and-more/-/raw/main/loader.exe"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944822/; classtype:trojan-activity;sid:84807922; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944823)"; flow:established,from_client; content:"GET"; http_method; content:"/artiessx/pubg-desync-menu/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944823/; classtype:trojan-activity;sid:84807923; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944821)"; flow:established,from_client; content:"GET"; http_method; content:"/lexxtsy/fortniteexternalcheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944821/; classtype:trojan-activity;sid:84807921; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944819)"; flow:established,from_client; content:"GET"; http_method; content:"/dreamscapes/redengine-fivem/-/raw/main/loader.exe"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944819/; classtype:trojan-activity;sid:84807919; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944820)"; flow:established,from_client; content:"GET"; http_method; content:"/runcover/genshin-impact-private-cheat-with-spoofer/-/raw/main/akebigc.exe"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944820/; classtype:trojan-activity;sid:84807920; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944817)"; flow:established,from_client; content:"GET"; http_method; content:"/litthewish/eulencheats-fivem/head/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944817/; classtype:trojan-activity;sid:84807917; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944818)"; flow:established,from_client; content:"GET"; http_method; content:"/scratty/quantv-december/-/raw/main/quantv_latest_2025.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944818/; classtype:trojan-activity;sid:84807918; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944815)"; flow:established,from_client; content:"GET"; http_method; content:"/ferrel1a/warzoneexternalcheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944815/; classtype:trojan-activity;sid:84807915; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944816)"; flow:established,from_client; content:"GET"; http_method; content:"/dellrux/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944816/; classtype:trojan-activity;sid:84807916; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944812)"; flow:established,from_client; content:"GET"; http_method; content:"/elmarties/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944812/; classtype:trojan-activity;sid:84807912; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944813)"; flow:established,from_client; content:"GET"; http_method; content:"/n1eys/solara/head/solara%20v3.exe"; http_uri; depth:34; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944813/; classtype:trojan-activity;sid:84807913; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944814)"; flow:established,from_client; content:"GET"; http_method; content:"/luerst/warzone-dominator/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944814/; classtype:trojan-activity;sid:84807914; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944811)"; flow:established,from_client; content:"GET"; http_method; content:"/oxfworld/warzone-dominator/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944811/; classtype:trojan-activity;sid:84807911; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944808)"; flow:established,from_client; content:"GET"; http_method; content:"/andrekhan/redengine-fivem/-/raw/main/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944808/; classtype:trojan-activity;sid:84807908; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944809)"; flow:established,from_client; content:"GET"; http_method; content:"/stellehif/valorantexternalcheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944809/; classtype:trojan-activity;sid:84807909; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944810)"; flow:established,from_client; content:"GET"; http_method; content:"/meggy99/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944810/; classtype:trojan-activity;sid:84807910; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944803)"; flow:established,from_client; content:"GET"; http_method; content:"/nightclay/fivem-external-cheat/-/raw/main/loader.exe"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944803/; classtype:trojan-activity;sid:84807903; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944804)"; flow:established,from_client; content:"GET"; http_method; content:"/mrcrowld/fivem-cheat-with-lua-executor-and-dumper/head/loader.exe"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944804/; classtype:trojan-activity;sid:84807904; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944805)"; flow:established,from_client; content:"GET"; http_method; content:"/madenhose/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944805/; classtype:trojan-activity;sid:84807905; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944806)"; flow:established,from_client; content:"GET"; http_method; content:"/honnleys/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944806/; classtype:trojan-activity;sid:84807906; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944807)"; flow:established,from_client; content:"GET"; http_method; content:"/hennelys/fivem-cheat-with-lua-executor-and-dumper/head/loader.exe"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944807/; classtype:trojan-activity;sid:84807907; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944800)"; flow:established,from_client; content:"GET"; http_method; content:"/theressjj/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944800/; classtype:trojan-activity;sid:84807900; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944801)"; flow:established,from_client; content:"GET"; http_method; content:"/linydev/eulencheats-fivem/-/raw/main/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944801/; classtype:trojan-activity;sid:84807901; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944802)"; flow:established,from_client; content:"GET"; http_method; content:"/overgrace/genshin-impact-private-cheat-with-spoofer/-/raw/main/akebigc.exe"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944802/; classtype:trojan-activity;sid:84807902; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944799)"; flow:established,from_client; content:"GET"; http_method; content:"/cevv1s/stalcraft-wh-chams-speedhack-fb/head/prg.rar"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944799/; classtype:trojan-activity;sid:84807899; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944796)"; flow:established,from_client; content:"GET"; http_method; content:"/altarealt/fluxus-executor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944796/; classtype:trojan-activity;sid:84807896; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944797)"; flow:established,from_client; content:"GET"; http_method; content:"/billygod/silentum-spoofer/-/raw/main/silentumspoofer.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944797/; classtype:trojan-activity;sid:84807897; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944798)"; flow:established,from_client; content:"GET"; http_method; content:"/nellypools/temp-spoofer-lifetime/-/raw/main/temp-spoofer.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944798/; classtype:trojan-activity;sid:84807898; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944795)"; flow:established,from_client; content:"GET"; http_method; content:"/slowwengeld/fivem-external-cheat/head/loader.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944795/; classtype:trojan-activity;sid:84807895; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944791)"; flow:established,from_client; content:"GET"; http_method; content:"/noterrls/eulencheats-fivem/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944791/; classtype:trojan-activity;sid:84807891; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944792)"; flow:established,from_client; content:"GET"; http_method; content:"/tezstewart/fivem-tz-project/-/raw/main/tz_project.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944792/; classtype:trojan-activity;sid:84807892; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944793)"; flow:established,from_client; content:"GET"; http_method; content:"/monachlet/warzone-dominator/head/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944793/; classtype:trojan-activity;sid:84807893; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944794)"; flow:established,from_client; content:"GET"; http_method; content:"/thayreactor/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944794/; classtype:trojan-activity;sid:84807894; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944790)"; flow:established,from_client; content:"GET"; http_method; content:"/hancyones/pubg-desync-menu/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944790/; classtype:trojan-activity;sid:84807890; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944785)"; flow:established,from_client; content:"GET"; http_method; content:"/x1leth/fluxusexecutor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944785/; classtype:trojan-activity;sid:84807885; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944786)"; flow:established,from_client; content:"GET"; http_method; content:"/nellishs/fivem-cheat-with-lua-executor-and-dumper/head/loader.exe"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944786/; classtype:trojan-activity;sid:84807886; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944787)"; flow:established,from_client; content:"GET"; http_method; content:"/skannyesh/pubg-desync-menu/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944787/; classtype:trojan-activity;sid:84807887; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944788)"; flow:established,from_client; content:"GET"; http_method; content:"/splashgaps/monotone-hwid-spoofer/-/raw/main/monotone-hwid-spoofer-master.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944788/; classtype:trojan-activity;sid:84807888; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944789)"; flow:established,from_client; content:"GET"; http_method; content:"/takemass/fortniteexternalcheat/head/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944789/; classtype:trojan-activity;sid:84807889; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944783)"; flow:established,from_client; content:"GET"; http_method; content:"/darrenbless/temp-spoofer-lifetime/-/raw/main/temp-spoofer.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944783/; classtype:trojan-activity;sid:84807883; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944784)"; flow:established,from_client; content:"GET"; http_method; content:"/thayabrix/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944784/; classtype:trojan-activity;sid:84807884; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944781)"; flow:established,from_client; content:"GET"; http_method; content:"/rinecchsy/valorantexternalcheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944781/; classtype:trojan-activity;sid:84807881; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944782)"; flow:established,from_client; content:"GET"; http_method; content:"/crystalchase/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:118; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944782/; classtype:trojan-activity;sid:84807882; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944779)"; flow:established,from_client; content:"GET"; http_method; content:"/smokedouts/temp-spoofer-lifetime/-/raw/main/temp-spoofer.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944779/; classtype:trojan-activity;sid:84807879; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944780)"; flow:established,from_client; content:"GET"; http_method; content:"/rockystars/fivem-external-cheat-27309/-/raw/main/loader.exe"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944780/; classtype:trojan-activity;sid:84807880; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944776)"; flow:established,from_client; content:"GET"; http_method; content:"/leavealones/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944776/; classtype:trojan-activity;sid:84807876; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944777)"; flow:established,from_client; content:"GET"; http_method; content:"/benztruck/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944777/; classtype:trojan-activity;sid:84807877; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944778)"; flow:established,from_client; content:"GET"; http_method; content:"/blackdrose/quantv-sp-fivem-ragemp-altv/head/_uninstall/quantv_uninstall.exe"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944778/; classtype:trojan-activity;sid:84807878; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944775)"; flow:established,from_client; content:"GET"; http_method; content:"/tell1sy/valorantexternalcheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944775/; classtype:trojan-activity;sid:84807875; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944773)"; flow:established,from_client; content:"GET"; http_method; content:"/alfredozorba018/redengine-fivem/-/raw/main/loader.exe"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944773/; classtype:trojan-activity;sid:84807873; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944774)"; flow:established,from_client; content:"GET"; http_method; content:"/luminatystage/fivem-spoofer/-/raw/main/fivemspoofer.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944774/; classtype:trojan-activity;sid:84807874; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944770)"; flow:established,from_client; content:"GET"; http_method; content:"/l3sshand/warzoneexternalcheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944770/; classtype:trojan-activity;sid:84807870; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944771)"; flow:established,from_client; content:"GET"; http_method; content:"/cry1jas/phoenixc2/head/phoenixc2.exe"; http_uri; depth:37; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944771/; classtype:trojan-activity;sid:84807871; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944772)"; flow:established,from_client; content:"GET"; http_method; content:"/lorr3rk/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944772/; classtype:trojan-activity;sid:84807872; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944769)"; flow:established,from_client; content:"GET"; http_method; content:"/n3aslem/fivem-mod-menu/head/loader.exe"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944769/; classtype:trojan-activity;sid:84807869; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944765)"; flow:established,from_client; content:"GET"; http_method; content:"/mikellyss/fortniteexternalcheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944765/; classtype:trojan-activity;sid:84807865; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944766)"; flow:established,from_client; content:"GET"; http_method; content:"/ecce1yh/fivem-external-cheat/head/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944766/; classtype:trojan-activity;sid:84807866; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944767)"; flow:established,from_client; content:"GET"; http_method; content:"/rockyhunts/fluxus-executor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944767/; classtype:trojan-activity;sid:84807867; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944768)"; flow:established,from_client; content:"GET"; http_method; content:"/ciao67926/skriptgg/-/raw/main/skriptgg.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944768/; classtype:trojan-activity;sid:84807868; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944764)"; flow:established,from_client; content:"GET"; http_method; content:"/castillogang/redengine-fivem/-/raw/main/loader.exe"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944764/; classtype:trojan-activity;sid:84807864; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944762)"; flow:established,from_client; content:"GET"; http_method; content:"/betakk1/roblox-macro-v3.0.0/head/spencer%20macro%20client.exe"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944762/; classtype:trojan-activity;sid:84807862; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944763)"; flow:established,from_client; content:"GET"; http_method; content:"/shannypolls/pubg-desync-menu/head/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944763/; classtype:trojan-activity;sid:84807863; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944759)"; flow:established,from_client; content:"GET"; http_method; content:"/cherrisland/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944759/; classtype:trojan-activity;sid:84807859; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944760)"; flow:established,from_client; content:"GET"; http_method; content:"/thevens/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944760/; classtype:trojan-activity;sid:84807860; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944761)"; flow:established,from_client; content:"GET"; http_method; content:"/braa1rl/c2panel/head/c2panel.exe"; http_uri; depth:33; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944761/; classtype:trojan-activity;sid:84807861; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944758)"; flow:established,from_client; content:"GET"; http_method; content:"/moreways/temp-spoofer-lifetime/-/raw/main/temp-spoofer.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944758/; classtype:trojan-activity;sid:84807858; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944757)"; flow:established,from_client; content:"GET"; http_method; content:"/laugxs/skriptgg/head/skriptgg.exe"; http_uri; depth:34; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944757/; classtype:trojan-activity;sid:84807857; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944754)"; flow:established,from_client; content:"GET"; http_method; content:"/nightfurys/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944754/; classtype:trojan-activity;sid:84807854; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944755)"; flow:established,from_client; content:"GET"; http_method; content:"/evolintent/fluxus-executor/-/raw/main/fluxusexecutor.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944755/; classtype:trojan-activity;sid:84807855; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944756)"; flow:established,from_client; content:"GET"; http_method; content:"/burnlights/fortnitespoofer/-/raw/main/fortnitespoofer.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944756/; classtype:trojan-activity;sid:84807856; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944748)"; flow:established,from_client; content:"GET"; http_method; content:"/jaygreens/skriptgg/-/raw/main/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944748/; classtype:trojan-activity;sid:84807848; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944749)"; flow:established,from_client; content:"GET"; http_method; content:"/alessocream/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944749/; classtype:trojan-activity;sid:84807849; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944750)"; flow:established,from_client; content:"GET"; http_method; content:"/istaffh/c2panel/head/c2panel.exe"; http_uri; depth:33; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944750/; classtype:trojan-activity;sid:84807850; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944751)"; flow:established,from_client; content:"GET"; http_method; content:"/shevv1ls/phoenixc2/head/phoenixc2.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944751/; classtype:trojan-activity;sid:84807851; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944752)"; flow:established,from_client; content:"GET"; http_method; content:"/n1essl/redengine-fivem/head/loader.exe"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944752/; classtype:trojan-activity;sid:84807852; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944753)"; flow:established,from_client; content:"GET"; http_method; content:"/sse1rls/valorantexternalcheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944753/; classtype:trojan-activity;sid:84807853; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944745)"; flow:established,from_client; content:"GET"; http_method; content:"/luxxinay/redengine-fivem/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944745/; classtype:trojan-activity;sid:84807845; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944746)"; flow:established,from_client; content:"GET"; http_method; content:"/blestoff/fivem-mod-menu/head/loader.exe"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944746/; classtype:trojan-activity;sid:84807846; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944747)"; flow:established,from_client; content:"GET"; http_method; content:"/grandstary/eulencheats-fivem/-/raw/main/loader.exe"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944747/; classtype:trojan-activity;sid:84807847; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944741)"; flow:established,from_client; content:"GET"; http_method; content:"/evanbluess/fivem-mod-menu/-/raw/main/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944741/; classtype:trojan-activity;sid:84807841; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944742)"; flow:established,from_client; content:"GET"; http_method; content:"/chrisruth/genshin-impact-private-cheat-with-spoofer/-/raw/main/akebigc.exe"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944742/; classtype:trojan-activity;sid:84807842; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944743)"; flow:established,from_client; content:"GET"; http_method; content:"/renwayne/fluxus-roblox-executor/head/fluxus%20v7.exe"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944743/; classtype:trojan-activity;sid:84807843; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944744)"; flow:established,from_client; content:"GET"; http_method; content:"/rlyssl0v3/fivem-mod-menu/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944744/; classtype:trojan-activity;sid:84807844; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944739)"; flow:established,from_client; content:"GET"; http_method; content:"/lestraccs/valorantexternalcheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944739/; classtype:trojan-activity;sid:84807839; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944740)"; flow:established,from_client; content:"GET"; http_method; content:"/spindoctors/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944740/; classtype:trojan-activity;sid:84807840; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944738)"; flow:established,from_client; content:"GET"; http_method; content:"/hinessylan/fortnitespoofer/-/raw/main/fortnitespoofer.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944738/; classtype:trojan-activity;sid:84807838; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944737)"; flow:established,from_client; content:"GET"; http_method; content:"/lutrhsww/redengine-fivem/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944737/; classtype:trojan-activity;sid:84807837; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944735)"; flow:established,from_client; content:"GET"; http_method; content:"/graymid/tinnylieh/-/raw/main/u7q7r23u7669.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944735/; classtype:trojan-activity;sid:84807835; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944736)"; flow:established,from_client; content:"GET"; http_method; content:"/calciers/valorantexternalcheat/head/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944736/; classtype:trojan-activity;sid:84807836; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944734)"; flow:established,from_client; content:"GET"; http_method; content:"/tenn1kls/warzone-dominator/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944734/; classtype:trojan-activity;sid:84807834; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944733)"; flow:established,from_client; content:"GET"; http_method; content:"/amem1lad/phoenixc2/head/phoenixc2.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944733/; classtype:trojan-activity;sid:84807833; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944729)"; flow:established,from_client; content:"GET"; http_method; content:"/onel1ms/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944729/; classtype:trojan-activity;sid:84807829; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944730)"; flow:established,from_client; content:"GET"; http_method; content:"/nutzerrm/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944730/; classtype:trojan-activity;sid:84807830; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944731)"; flow:established,from_client; content:"GET"; http_method; content:"/grapmorphie/fivem-tz-project/-/raw/main/tz_project.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944731/; classtype:trojan-activity;sid:84807831; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944732)"; flow:established,from_client; content:"GET"; http_method; content:"/sall1yt/fivem-external-cheat/head/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944732/; classtype:trojan-activity;sid:84807832; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944724)"; flow:established,from_client; content:"GET"; http_method; content:"/stayflye/fortnite-ragdoll-v2-privcheat-including-softaim-esp-wallhack-triggerbot-and-more/-/raw/main/loader.exe"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944724/; classtype:trojan-activity;sid:84807824; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944725)"; flow:established,from_client; content:"GET"; http_method; content:"/hennyks/swift-executor/head/swift.exe"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944725/; classtype:trojan-activity;sid:84807825; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944726)"; flow:established,from_client; content:"GET"; http_method; content:"/limpachs/quantv-sp-fivem-ragemp-altv/head/_uninstall/quantv_uninstall.exe"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944726/; classtype:trojan-activity;sid:84807826; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944727)"; flow:established,from_client; content:"GET"; http_method; content:"/l1tteys/quantv-sp-fivem-ragemp-altv/head/_uninstall/quantv_uninstall.exe"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944727/; classtype:trojan-activity;sid:84807827; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944728)"; flow:established,from_client; content:"GET"; http_method; content:"/kylerich/skriptgg/-/raw/main/skriptgg.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944728/; classtype:trojan-activity;sid:84807828; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944722)"; flow:established,from_client; content:"GET"; http_method; content:"/piedeo/fivem-mod-menu/-/raw/main/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944722/; classtype:trojan-activity;sid:84807822; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944723)"; flow:established,from_client; content:"GET"; http_method; content:"/bitstackdev/valorantexternalcheat/head/loader.exe"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944723/; classtype:trojan-activity;sid:84807823; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944716)"; flow:established,from_client; content:"GET"; http_method; content:"/mopies/temp-spoofer-lifetime/-/raw/main/temp-spoofer.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944716/; classtype:trojan-activity;sid:84807816; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944717)"; flow:established,from_client; content:"GET"; http_method; content:"/vangerbit/pubg-desync-menu/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944717/; classtype:trojan-activity;sid:84807817; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944718)"; flow:established,from_client; content:"GET"; http_method; content:"/fluxlyds/redengine-fivem/-/raw/main/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944718/; classtype:trojan-activity;sid:84807818; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944719)"; flow:established,from_client; content:"GET"; http_method; content:"/khannrover/fivem-external-cheat/-/raw/main/loader.exe"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944719/; classtype:trojan-activity;sid:84807819; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944720)"; flow:established,from_client; content:"GET"; http_method; content:"/crashfine/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944720/; classtype:trojan-activity;sid:84807820; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944721)"; flow:established,from_client; content:"GET"; http_method; content:"/frankblazz/redengine-fivem/-/raw/main/loader.exe"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944721/; classtype:trojan-activity;sid:84807821; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944715)"; flow:established,from_client; content:"GET"; http_method; content:"/all1and/c2panel/head/c2panel.exe"; http_uri; depth:33; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944715/; classtype:trojan-activity;sid:84807815; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944714)"; flow:established,from_client; content:"GET"; http_method; content:"/stevehook/fortnitespoofer/-/raw/main/fortnitespoofer.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944714/; classtype:trojan-activity;sid:84807814; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944713)"; flow:established,from_client; content:"GET"; http_method; content:"/hexxycally/code/-/raw/main/stage_2.exe"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944713/; classtype:trojan-activity;sid:84807813; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944711)"; flow:established,from_client; content:"GET"; http_method; content:"/lucklords/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944711/; classtype:trojan-activity;sid:84807811; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944712)"; flow:established,from_client; content:"GET"; http_method; content:"/honsyxx/fortniteexternalcheat/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944712/; classtype:trojan-activity;sid:84807812; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944710)"; flow:established,from_client; content:"GET"; http_method; content:"/janneclimb/lunaexecutor/-/raw/main/lunaexecutor.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944710/; classtype:trojan-activity;sid:84807810; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944709)"; flow:established,from_client; content:"GET"; http_method; content:"/fierrids/skriptgg/head/skriptgg.exe"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944709/; classtype:trojan-activity;sid:84807809; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944708)"; flow:established,from_client; content:"GET"; http_method; content:"/gracerivals/warzone-dominator/head/loader.exe"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944708/; classtype:trojan-activity;sid:84807808; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944706)"; flow:established,from_client; content:"GET"; http_method; content:"/randydiva/monotone-hwid-spoofer/-/raw/main/monotone-hwid-spoofer-master.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944706/; classtype:trojan-activity;sid:84807806; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944707)"; flow:established,from_client; content:"GET"; http_method; content:"/nikkyhalk/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944707/; classtype:trojan-activity;sid:84807807; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944704)"; flow:established,from_client; content:"GET"; http_method; content:"/sophyeess/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944704/; classtype:trojan-activity;sid:84807804; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944705)"; flow:established,from_client; content:"GET"; http_method; content:"/forrel1s/pubg-desync-menu/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944705/; classtype:trojan-activity;sid:84807805; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944703)"; flow:established,from_client; content:"GET"; http_method; content:"/harribes/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944703/; classtype:trojan-activity;sid:84807803; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944702)"; flow:established,from_client; content:"GET"; http_method; content:"/chrisdior/temp-spoofer-lifetime/-/raw/main/temp-spoofer.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944702/; classtype:trojan-activity;sid:84807802; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944701)"; flow:established,from_client; content:"GET"; http_method; content:"/cxdleer/fivem-external-cheat/head/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944701/; classtype:trojan-activity;sid:84807801; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944700)"; flow:established,from_client; content:"GET"; http_method; content:"/pitmarky/fivem-spoofer/-/raw/main/fivemspoofer.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944700/; classtype:trojan-activity;sid:84807800; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944699)"; flow:established,from_client; content:"GET"; http_method; content:"/playfuld/xeno-executor/-/raw/main/xenoexecutor.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944699/; classtype:trojan-activity;sid:84807799; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944698)"; flow:established,from_client; content:"GET"; http_method; content:"/bennycastle/solaraexecutor/-/raw/main/solaraexecutor.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944698/; classtype:trojan-activity;sid:84807798; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944696)"; flow:established,from_client; content:"GET"; http_method; content:"/ciao67926/fivem-mod-menu/-/raw/main/loader.exe"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944696/; classtype:trojan-activity;sid:84807796; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944697)"; flow:established,from_client; content:"GET"; http_method; content:"/sheffhallow/fivem-spoofer/-/raw/main/fivemspoofer.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944697/; classtype:trojan-activity;sid:84807797; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944695)"; flow:established,from_client; content:"GET"; http_method; content:"/changehort/synapsex/-/raw/main/synapsex.zip"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"gitlab.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944695/; classtype:trojan-activity;sid:84807795; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944681)"; flow:established,from_client; content:"GET"; http_method; content:"/downesx/fivem-external-cheat/head/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944681/; classtype:trojan-activity;sid:84807781; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944682)"; flow:established,from_client; content:"GET"; http_method; content:"/jaellds/fivem-external-cheat/head/loader.exe"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944682/; classtype:trojan-activity;sid:84807782; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944683)"; flow:established,from_client; content:"GET"; http_method; content:"/skannyhampt/fortniteexternalcheat/head/loader.exe"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944683/; classtype:trojan-activity;sid:84807783; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944684)"; flow:established,from_client; content:"GET"; http_method; content:"/addels7/warzone-dominator/head/loader.exe"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944684/; classtype:trojan-activity;sid:84807784; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944685)"; flow:established,from_client; content:"GET"; http_method; content:"/essywh/fivem-external-cheat/head/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944685/; classtype:trojan-activity;sid:84807785; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944686)"; flow:established,from_client; content:"GET"; http_method; content:"/nicthlans/warzone-dominator/head/loader.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944686/; classtype:trojan-activity;sid:84807786; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944687)"; flow:established,from_client; content:"GET"; http_method; content:"/limmomixxs/fortnitespoofer/head/tempspoofer.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944687/; classtype:trojan-activity;sid:84807787; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944688)"; flow:established,from_client; content:"GET"; http_method; content:"/misserlys/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944688/; classtype:trojan-activity;sid:84807788; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944689)"; flow:established,from_client; content:"GET"; http_method; content:"/sillentl0vely/swift-executor/head/swift.exe"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944689/; classtype:trojan-activity;sid:84807789; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944690)"; flow:established,from_client; content:"GET"; http_method; content:"/bittlanes/fluxus-roblox-executor/head/fluxus%20v7.exe"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944690/; classtype:trojan-activity;sid:84807790; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944691)"; flow:established,from_client; content:"GET"; http_method; content:"/lakecase/redengine-fivem/head/loader.exe"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944691/; classtype:trojan-activity;sid:84807791; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944692)"; flow:established,from_client; content:"GET"; http_method; content:"/kesslyy27/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944692/; classtype:trojan-activity;sid:84807792; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944693)"; flow:established,from_client; content:"GET"; http_method; content:"/mallymeyh/fortniteexternalcheat/head/loader.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944693/; classtype:trojan-activity;sid:84807793; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944694)"; flow:established,from_client; content:"GET"; http_method; content:"/arilles99/temp-spoofer-lifetime/head/tempspoofer.exe"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944694/; classtype:trojan-activity;sid:84807794; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944679)"; flow:established,from_client; content:"GET"; http_method; content:"/exgraphs/swift-executor/head/swift.exe"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944679/; classtype:trojan-activity;sid:84807779; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944680)"; flow:established,from_client; content:"GET"; http_method; content:"/lpisstuck/skriptgg/head/skriptgg.exe"; http_uri; depth:37; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944680/; classtype:trojan-activity;sid:84807780; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944676)"; flow:established,from_client; content:"GET"; http_method; content:"/nrevv1lad/pubg-desync-menu/head/loader.exe"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944676/; classtype:trojan-activity;sid:84807776; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944677)"; flow:established,from_client; content:"GET"; http_method; content:"/moffb/c2panel/head/c2panel.exe"; http_uri; depth:31; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944677/; classtype:trojan-activity;sid:84807777; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944678)"; flow:established,from_client; content:"GET"; http_method; content:"/badd1lucky/xeno-executor/head/xeno.exe"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944678/; classtype:trojan-activity;sid:84807778; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944675)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"183.158.16.87"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944675/; classtype:trojan-activity;sid:84807775; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944674)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.160.220.86"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944674/; classtype:trojan-activity;sid:84807774; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944670)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.186.220.222"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944670/; classtype:trojan-activity;sid:84807770; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944671)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.127.242.213"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944671/; classtype:trojan-activity;sid:84807771; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944672)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.56.147.183"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944672/; classtype:trojan-activity;sid:84807772; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944673)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.231.228.32"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944673/; classtype:trojan-activity;sid:84807773; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944669)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"177.84.28.147"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944669/; classtype:trojan-activity;sid:84807769; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944668)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"105.186.220.222"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944668/; classtype:trojan-activity;sid:84807768; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944666)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.127.242.213"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944666/; classtype:trojan-activity;sid:84807766; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944667)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.85.134.168"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944667/; classtype:trojan-activity;sid:84807767; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944665)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.12.229.137"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944665/; classtype:trojan-activity;sid:84807765; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944664)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"121.234.248.185"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944664/; classtype:trojan-activity;sid:84807764; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944663)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.165.80.95"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944663/; classtype:trojan-activity;sid:84807763; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944661)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"39.85.13.115"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944661/; classtype:trojan-activity;sid:84807761; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944662)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"117.223.141.211"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944662/; classtype:trojan-activity;sid:84807762; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944659)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.5.118.27"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944659/; classtype:trojan-activity;sid:84807759; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944660)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.13.85.107"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944660/; classtype:trojan-activity;sid:84807760; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944658)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.121.67.84"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944658/; classtype:trojan-activity;sid:84807758; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944657)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"117.223.141.211"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944657/; classtype:trojan-activity;sid:84807757; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944656)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.121.67.84"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944656/; classtype:trojan-activity;sid:84807756; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944655)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.51.121.113"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944655/; classtype:trojan-activity;sid:84807755; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944653)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"196.189.3.1"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944653/; classtype:trojan-activity;sid:84807753; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944654)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.189.3.1"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944654/; classtype:trojan-activity;sid:84807754; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944652)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.5.118.27"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944652/; classtype:trojan-activity;sid:84807752; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944650)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.52.213.183"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944650/; classtype:trojan-activity;sid:84807750; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944651)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.186.254.58"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944651/; classtype:trojan-activity;sid:84807751; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944648)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.191.104.40"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944648/; classtype:trojan-activity;sid:84807748; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944649)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"163.142.94.209"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944649/; classtype:trojan-activity;sid:84807749; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944647)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"171.213.235.186"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944647/; classtype:trojan-activity;sid:84807747; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944645)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.49.201.133"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944645/; classtype:trojan-activity;sid:84807745; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944646)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.47.113.29"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944646/; classtype:trojan-activity;sid:84807746; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944641)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.97.253.76"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944641/; classtype:trojan-activity;sid:84807741; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944642)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.113.6.188"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944642/; classtype:trojan-activity;sid:84807742; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944643)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.87.145.61"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944643/; classtype:trojan-activity;sid:84807743; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944644)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.8.8.177"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944644/; classtype:trojan-activity;sid:84807744; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944640)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"58.208.136.87"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944640/; classtype:trojan-activity;sid:84807740; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944639)"; flow:established,from_client; content:"GET"; http_method; content:"/files/sofa/file.exe"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"62.60.226.140"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944639/; classtype:trojan-activity;sid:84807739; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944638)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"110.136.5.74"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944638/; classtype:trojan-activity;sid:84807738; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944634)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"164.163.25.149"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944634/; classtype:trojan-activity;sid:84807734; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944635)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"105.224.60.120"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944635/; classtype:trojan-activity;sid:84807735; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944636)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"58.47.105.224"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944636/; classtype:trojan-activity;sid:84807736; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944637)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.8.6.242"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944637/; classtype:trojan-activity;sid:84807737; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944633)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.138.216.248"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944633/; classtype:trojan-activity;sid:84807733; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944630)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"164.163.25.149"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944630/; classtype:trojan-activity;sid:84807730; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944631)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"170.254.10.219"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944631/; classtype:trojan-activity;sid:84807731; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944632)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"59.97.253.76"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944632/; classtype:trojan-activity;sid:84807732; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944628)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.8.6.242"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944628/; classtype:trojan-activity;sid:84807728; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944629)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.138.117.220"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944629/; classtype:trojan-activity;sid:84807729; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944626)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.207.38.255"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944626/; classtype:trojan-activity;sid:84807726; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944627)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.53.1.177"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944627/; classtype:trojan-activity;sid:84807727; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944625)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.238.69.210"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944625/; classtype:trojan-activity;sid:84807725; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944621)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"58.47.121.68"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944621/; classtype:trojan-activity;sid:84807721; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944622)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.4.127.9"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944622/; classtype:trojan-activity;sid:84807722; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944623)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.84.214.178"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944623/; classtype:trojan-activity;sid:84807723; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944624)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.19.83.106"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944624/; classtype:trojan-activity;sid:84807724; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944617)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"46.72.83.225"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944617/; classtype:trojan-activity;sid:84807717; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944618)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"46.72.83.225"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944618/; classtype:trojan-activity;sid:84807718; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944619)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.165.80.95"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944619/; classtype:trojan-activity;sid:84807719; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944620)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.175.27.178"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944620/; classtype:trojan-activity;sid:84807720; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944615)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.141.103.165"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944615/; classtype:trojan-activity;sid:84807715; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944616)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.141.103.165"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944616/; classtype:trojan-activity;sid:84807716; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944613)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"45.171.177.193"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944613/; classtype:trojan-activity;sid:84807713; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944614)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.53.1.177"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944614/; classtype:trojan-activity;sid:84807714; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944612)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"1.62.112.38"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944612/; classtype:trojan-activity;sid:84807712; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944611)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"58.47.121.68"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944611/; classtype:trojan-activity;sid:84807711; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944610)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"180.190.188.110"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944610/; classtype:trojan-activity;sid:84807710; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944609)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.52.32.163"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944609/; classtype:trojan-activity;sid:84807709; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944604)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.127.73.15"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944604/; classtype:trojan-activity;sid:84807704; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944605)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.23.233.72"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944605/; classtype:trojan-activity;sid:84807705; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944606)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.215.208.40"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944606/; classtype:trojan-activity;sid:84807706; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944607)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.175.27.178"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944607/; classtype:trojan-activity;sid:84807707; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944608)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.185.222.14"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944608/; classtype:trojan-activity;sid:84807708; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944603)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.215.208.40"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944603/; classtype:trojan-activity;sid:84807703; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944602)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.191.231.12"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944602/; classtype:trojan-activity;sid:84807702; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944601)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"140.237.48.186"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944601/; classtype:trojan-activity;sid:84807701; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944600)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.167.87.144"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944600/; classtype:trojan-activity;sid:84807700; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944599)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.126.90.15"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944599/; classtype:trojan-activity;sid:84807699; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944597)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.174.15.183"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944597/; classtype:trojan-activity;sid:84807697; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944598)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.174.15.183"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944598/; classtype:trojan-activity;sid:84807698; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944596)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.23.233.72"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944596/; classtype:trojan-activity;sid:84807696; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944595)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.37.102.186"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944595/; classtype:trojan-activity;sid:84807695; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944594)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.106.111.244"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944594/; classtype:trojan-activity;sid:84807694; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944593)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"117.40.42.234"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944593/; classtype:trojan-activity;sid:84807693; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944592)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"140.237.48.186"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944592/; classtype:trojan-activity;sid:84807692; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944591)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"180.243.51.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944591/; classtype:trojan-activity;sid:84807691; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944590)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"111.178.127.215"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944590/; classtype:trojan-activity;sid:84807690; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944588)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.154.102.233"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944588/; classtype:trojan-activity;sid:84807688; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944589)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.11.7.18"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944589/; classtype:trojan-activity;sid:84807689; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944585)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.224.83.188"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944585/; classtype:trojan-activity;sid:84807685; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944586)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.224.242.208"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944586/; classtype:trojan-activity;sid:84807686; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944587)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.175.239.99"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944587/; classtype:trojan-activity;sid:84807687; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944584)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.237.52.190"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944584/; classtype:trojan-activity;sid:84807684; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944582)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.148.157.126"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944582/; classtype:trojan-activity;sid:84807682; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944583)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.23.238.255"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944583/; classtype:trojan-activity;sid:84807683; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944581)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"111.178.127.215"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944581/; classtype:trojan-activity;sid:84807681; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944579)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.23.238.255"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944579/; classtype:trojan-activity;sid:84807679; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944580)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.148.154.43"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944580/; classtype:trojan-activity;sid:84807680; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944578)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"196.191.231.12"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944578/; classtype:trojan-activity;sid:84807678; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944576)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"112.228.200.135"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944576/; classtype:trojan-activity;sid:84807676; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944577)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.148.157.126"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944577/; classtype:trojan-activity;sid:84807677; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944574)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.231.42.173"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944574/; classtype:trojan-activity;sid:84807674; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944575)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.224.170.145"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944575/; classtype:trojan-activity;sid:84807675; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944573)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.52.195.242"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944573/; classtype:trojan-activity;sid:84807673; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944572)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"113.221.78.113"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944572/; classtype:trojan-activity;sid:84807672; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944571)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.127.87.252"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944571/; classtype:trojan-activity;sid:84807671; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944570)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.231.42.173"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944570/; classtype:trojan-activity;sid:84807670; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944566)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.126.113.116"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944566/; classtype:trojan-activity;sid:84807666; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944567)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.114.195.35"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944567/; classtype:trojan-activity;sid:84807667; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944568)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.147.93.100"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944568/; classtype:trojan-activity;sid:84807668; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944569)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.45.10.115"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944569/; classtype:trojan-activity;sid:84807669; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944564)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.152.11.189"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944564/; classtype:trojan-activity;sid:84807664; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944565)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.231.252.202"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944565/; classtype:trojan-activity;sid:84807665; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944563)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"38.7.36.42"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944563/; classtype:trojan-activity;sid:84807663; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944561)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.79.4.2"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944561/; classtype:trojan-activity;sid:84807661; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944562)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.116.77.73"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944562/; classtype:trojan-activity;sid:84807662; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944559)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.114.195.35"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944559/; classtype:trojan-activity;sid:84807659; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944560)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"220.161.100.55"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_08; reference:url, urlhaus.abuse.ch/url/3944560/; classtype:trojan-activity;sid:84807660; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944558)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.230.38.212"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944558/; classtype:trojan-activity;sid:84807658; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944557)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"117.91.113.150"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944557/; classtype:trojan-activity;sid:84807657; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944555)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"39.71.177.225"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944555/; classtype:trojan-activity;sid:84807655; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944556)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.138.148.198"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944556/; classtype:trojan-activity;sid:84807656; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944554)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"112.233.65.251"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944554/; classtype:trojan-activity;sid:84807654; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944551)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.127.87.252"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944551/; classtype:trojan-activity;sid:84807651; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944552)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.126.113.116"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944552/; classtype:trojan-activity;sid:84807652; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944553)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.112.1.67"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944553/; classtype:trojan-activity;sid:84807653; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944549)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.189.98.77"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944549/; classtype:trojan-activity;sid:84807649; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944550)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.117.78.141"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944550/; classtype:trojan-activity;sid:84807650; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944548)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"112.233.65.251"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944548/; classtype:trojan-activity;sid:84807648; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944547)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"220.161.100.55"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944547/; classtype:trojan-activity;sid:84807647; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944546)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.237.251.149"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944546/; classtype:trojan-activity;sid:84807646; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944541)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"103.157.210.26"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944541/; classtype:trojan-activity;sid:84807641; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944542)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.130.203.216"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944542/; classtype:trojan-activity;sid:84807642; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944543)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.117.78.141"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944543/; classtype:trojan-activity;sid:84807643; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944544)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"39.71.177.225"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944544/; classtype:trojan-activity;sid:84807644; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944545)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.202.187.80"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944545/; classtype:trojan-activity;sid:84807645; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944540)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.79.177.52"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944540/; classtype:trojan-activity;sid:84807640; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944539)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.52.132.92"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944539/; classtype:trojan-activity;sid:84807639; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944538)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.57.255.84"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944538/; classtype:trojan-activity;sid:84807638; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944537)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.179.253.121"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944537/; classtype:trojan-activity;sid:84807637; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944534)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.157.67.216"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944534/; classtype:trojan-activity;sid:84807634; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944535)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.94.58.101"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944535/; classtype:trojan-activity;sid:84807635; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944536)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"61.52.132.92"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944536/; classtype:trojan-activity;sid:84807636; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944533)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"81.236.234.16"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944533/; classtype:trojan-activity;sid:84807633; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944532)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.220.121.135"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944532/; classtype:trojan-activity;sid:84807632; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944530)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.215.122.184"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944530/; classtype:trojan-activity;sid:84807630; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944531)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.79.177.52"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944531/; classtype:trojan-activity;sid:84807631; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944528)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.18.58.38"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944528/; classtype:trojan-activity;sid:84807628; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944529)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.23.238.198"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944529/; classtype:trojan-activity;sid:84807629; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944527)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.147.95.196"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944527/; classtype:trojan-activity;sid:84807627; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944526)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"219.157.67.216"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944526/; classtype:trojan-activity;sid:84807626; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944524)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.43.32.223"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944524/; classtype:trojan-activity;sid:84807624; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944525)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"117.44.248.73"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944525/; classtype:trojan-activity;sid:84807625; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944523)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.238.171.110"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944523/; classtype:trojan-activity;sid:84807623; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944522)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.42.54.216"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944522/; classtype:trojan-activity;sid:84807622; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944519)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.215.122.184"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944519/; classtype:trojan-activity;sid:84807619; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944520)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"63.245.153.41"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944520/; classtype:trojan-activity;sid:84807620; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944521)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.96.141.68"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944521/; classtype:trojan-activity;sid:84807621; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944517)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.14.152.208"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944517/; classtype:trojan-activity;sid:84807617; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944518)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"39.82.142.95"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944518/; classtype:trojan-activity;sid:84807618; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944516)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"119.117.173.54"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944516/; classtype:trojan-activity;sid:84807616; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944515)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.57.205.133"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944515/; classtype:trojan-activity;sid:84807615; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944513)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.57.194.13"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944513/; classtype:trojan-activity;sid:84807613; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944514)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.238.161.32"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944514/; classtype:trojan-activity;sid:84807614; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944512)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.190.224.233"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944512/; classtype:trojan-activity;sid:84807612; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944511)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.50.222.52"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944511/; classtype:trojan-activity;sid:84807611; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944510)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.50.222.52"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944510/; classtype:trojan-activity;sid:84807610; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944508)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.63.145.226"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944508/; classtype:trojan-activity;sid:84807608; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944509)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.63.12.140"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944509/; classtype:trojan-activity;sid:84807609; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944507)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"85.95.191.148"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944507/; classtype:trojan-activity;sid:84807607; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944506)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"113.238.161.32"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944506/; classtype:trojan-activity;sid:84807606; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944505)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.219.74.116"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944505/; classtype:trojan-activity;sid:84807605; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944502)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"114.226.203.225"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944502/; classtype:trojan-activity;sid:84807602; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944503)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"180.191.49.27"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944503/; classtype:trojan-activity;sid:84807603; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944504)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.221.78.113"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944504/; classtype:trojan-activity;sid:84807604; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944501)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.52.159.83"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944501/; classtype:trojan-activity;sid:84807601; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944500)"; flow:established,from_client; content:"GET"; http_method; content:"/files-129312398/files/file_a91bba92fab4558e.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"91.92.242.236"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944500/; classtype:trojan-activity;sid:84807600; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944499)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"78.38.123.220"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944499/; classtype:trojan-activity;sid:84807599; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944496)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.177.197.176"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944496/; classtype:trojan-activity;sid:84807596; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944497)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"163.142.95.171"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944497/; classtype:trojan-activity;sid:84807597; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944498)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"114.226.203.225"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944498/; classtype:trojan-activity;sid:84807598; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944494)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.57.62.230"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944494/; classtype:trojan-activity;sid:84807594; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944495)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.9.194.116"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944495/; classtype:trojan-activity;sid:84807595; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944493)"; flow:established,from_client; content:"GET"; http_method; content:"/jklarm7"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"176.65.139.40"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944493/; classtype:trojan-activity;sid:84807593; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944492)"; flow:established,from_client; content:"GET"; http_method; content:"/jklarm"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"176.65.139.40"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944492/; classtype:trojan-activity;sid:84807592; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944491)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.234.235.206"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944491/; classtype:trojan-activity;sid:84807591; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944490)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.5.255.162"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944490/; classtype:trojan-activity;sid:84807590; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944489)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"112.239.160.128"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944489/; classtype:trojan-activity;sid:84807589; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944488)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"36.49.52.140"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944488/; classtype:trojan-activity;sid:84807588; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944487)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.127.158.71"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944487/; classtype:trojan-activity;sid:84807587; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944486)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.5.255.162"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944486/; classtype:trojan-activity;sid:84807586; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944485)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"105.224.249.40"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944485/; classtype:trojan-activity;sid:84807585; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944484)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.234.99.214"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944484/; classtype:trojan-activity;sid:84807584; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944483)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.231.187.27"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944483/; classtype:trojan-activity;sid:84807583; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944477)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"36.64.184.26"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944477/; classtype:trojan-activity;sid:84807577; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944478)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.109.122.254"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944478/; classtype:trojan-activity;sid:84807578; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944479)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.140.158.225"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944479/; classtype:trojan-activity;sid:84807579; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944480)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"218.16.164.137"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944480/; classtype:trojan-activity;sid:84807580; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944481)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"180.191.22.126"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944481/; classtype:trojan-activity;sid:84807581; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944482)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.172.26.116"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944482/; classtype:trojan-activity;sid:84807582; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944476)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.172.26.116"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944476/; classtype:trojan-activity;sid:84807576; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944472)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.55.51.3"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944472/; classtype:trojan-activity;sid:84807572; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944473)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"38.58.201.172"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944473/; classtype:trojan-activity;sid:84807573; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944474)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.28.82.26"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944474/; classtype:trojan-activity;sid:84807574; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944475)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.5.35.52"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944475/; classtype:trojan-activity;sid:84807575; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944471)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.140.158.225"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944471/; classtype:trojan-activity;sid:84807571; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944468)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.148.159.140"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944468/; classtype:trojan-activity;sid:84807568; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944469)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"180.191.22.126"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944469/; classtype:trojan-activity;sid:84807569; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944470)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"119.109.122.254"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944470/; classtype:trojan-activity;sid:84807570; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944467)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.23.235.152"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944467/; classtype:trojan-activity;sid:84807567; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944466)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.165.106.206"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944466/; classtype:trojan-activity;sid:84807566; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944462)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"110.136.98.92"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944462/; classtype:trojan-activity;sid:84807562; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944463)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"121.234.248.185"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944463/; classtype:trojan-activity;sid:84807563; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944464)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"163.142.94.209"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944464/; classtype:trojan-activity;sid:84807564; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944465)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.55.51.3"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944465/; classtype:trojan-activity;sid:84807565; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944460)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.177.197.176"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944460/; classtype:trojan-activity;sid:84807560; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944461)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.153.38.114"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944461/; classtype:trojan-activity;sid:84807561; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944458)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.23.235.152"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944458/; classtype:trojan-activity;sid:84807558; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944459)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"177.86.229.12"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944459/; classtype:trojan-activity;sid:84807559; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944457)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"61.53.72.71"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944457/; classtype:trojan-activity;sid:84807557; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944456)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"186.149.204.12"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944456/; classtype:trojan-activity;sid:84807556; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944453)"; flow:established,from_client; content:"GET"; http_method; content:"/abeasinf/archivos/refs/heads/main/envio3.txt"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944453/; classtype:trojan-activity;sid:84807553; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944454)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.148.159.140"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944454/; classtype:trojan-activity;sid:84807554; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944455)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.52.94.6"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944455/; classtype:trojan-activity;sid:84807555; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944449)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.140.196.83"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944449/; classtype:trojan-activity;sid:84807549; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944450)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.97.253.220"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944450/; classtype:trojan-activity;sid:84807550; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944451)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.55.12.91"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944451/; classtype:trojan-activity;sid:84807551; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944452)"; flow:established,from_client; content:"GET"; http_method; content:"/abeasinf/archivos/refs/heads/main/edr.txt"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944452/; classtype:trojan-activity;sid:84807552; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944447)"; flow:established,from_client; content:"GET"; http_method; content:"/abeasinf/archivos/refs/heads/main/a001envio.txt"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944447/; classtype:trojan-activity;sid:84807547; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944448)"; flow:established,from_client; content:"GET"; http_method; content:"/abeasinf/archivos/refs/heads/main/savedstart.txt"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944448/; classtype:trojan-activity;sid:84807548; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944440)"; flow:established,from_client; content:"GET"; http_method; content:"/abeasinf/archivos/refs/heads/main/envio32b.txt"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944440/; classtype:trojan-activity;sid:84807540; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944441)"; flow:established,from_client; content:"GET"; http_method; content:"/abeasinf/archivos/refs/heads/main/rain.txt"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944441/; classtype:trojan-activity;sid:84807541; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944442)"; flow:established,from_client; content:"GET"; http_method; content:"/abeasinf/archivos/refs/heads/main/pure.txt"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944442/; classtype:trojan-activity;sid:84807542; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944443)"; flow:established,from_client; content:"GET"; http_method; content:"/abeasinf/archivos/refs/heads/main/salvado26.txt"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944443/; classtype:trojan-activity;sid:84807543; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944444)"; flow:established,from_client; content:"GET"; http_method; content:"/abeasinf/archivos/refs/heads/main/q.txt"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944444/; classtype:trojan-activity;sid:84807544; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944445)"; flow:established,from_client; content:"GET"; http_method; content:"/abeasinf/archivos/refs/heads/main/v6envio.txt"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944445/; classtype:trojan-activity;sid:84807545; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944446)"; flow:established,from_client; content:"GET"; http_method; content:"/abeasinf/archivos/refs/heads/main/a1enviogh.txt"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944446/; classtype:trojan-activity;sid:84807546; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944428)"; flow:established,from_client; content:"GET"; http_method; content:"/abeasinf/archivos/refs/heads/main/saved%20test.txt"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944428/; classtype:trojan-activity;sid:84807528; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944429)"; flow:established,from_client; content:"GET"; http_method; content:"/abeasinf/archivos/refs/heads/main/a1envionew.txt"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944429/; classtype:trojan-activity;sid:84807529; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944430)"; flow:established,from_client; content:"GET"; http_method; content:"/abeasinf/archivos/refs/heads/main/queso.txt"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944430/; classtype:trojan-activity;sid:84807530; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944431)"; flow:established,from_client; content:"GET"; http_method; content:"/abeasinf/archivos/refs/heads/main/ramgipk.txt"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944431/; classtype:trojan-activity;sid:84807531; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944432)"; flow:established,from_client; content:"GET"; http_method; content:"/abeasinf/archivos/refs/heads/main/wd.txt"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944432/; classtype:trojan-activity;sid:84807532; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944433)"; flow:established,from_client; content:"GET"; http_method; content:"/abeasinf/archivos/refs/heads/main/envio1gh.txt"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944433/; classtype:trojan-activity;sid:84807533; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944434)"; flow:established,from_client; content:"GET"; http_method; content:"/abeasinf/archivos/refs/heads/main/envio1uac.txt"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944434/; classtype:trojan-activity;sid:84807534; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944435)"; flow:established,from_client; content:"GET"; http_method; content:"/abeasinf/archivos/refs/heads/main/bro.txt"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944435/; classtype:trojan-activity;sid:84807535; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944436)"; flow:established,from_client; content:"GET"; http_method; content:"/abeasinf/archivos/refs/heads/main/paste.txt"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944436/; classtype:trojan-activity;sid:84807536; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944437)"; flow:established,from_client; content:"GET"; http_method; content:"/abeasinf/archivos/refs/heads/main/1uac.txt"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944437/; classtype:trojan-activity;sid:84807537; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944438)"; flow:established,from_client; content:"GET"; http_method; content:"/abeasinf/archivos/refs/heads/main/pureza.txt"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944438/; classtype:trojan-activity;sid:84807538; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944439)"; flow:established,from_client; content:"GET"; http_method; content:"/abeasinf/archivos/refs/heads/main/broxw.txt"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944439/; classtype:trojan-activity;sid:84807539; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944426)"; flow:established,from_client; content:"GET"; http_method; content:"/abeasinf/archivos/refs/heads/main/anew.txt"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944426/; classtype:trojan-activity;sid:84807526; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944427)"; flow:established,from_client; content:"GET"; http_method; content:"/abeasinf/archivos/refs/heads/main/a1envio.txt"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944427/; classtype:trojan-activity;sid:84807527; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944425)"; flow:established,from_client; content:"GET"; http_method; content:"/update.sh"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"plf7x.valci.store"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944425/; classtype:trojan-activity;sid:84807525; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944424)"; flow:established,from_client; content:"GET"; http_method; content:"/ridoyp99/xxxxxx/blob/main/lol.jpg"; http_uri; depth:34; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944424/; classtype:trojan-activity;sid:84807524; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944423)"; flow:established,from_client; content:"GET"; http_method; content:"/ridoyp99/xxxxxx/blob/main/xxe.xml"; http_uri; depth:34; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944423/; classtype:trojan-activity;sid:84807523; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944422)"; flow:established,from_client; content:"GET"; http_method; content:"/abeasinf/archivos/raw/refs/heads/main/anew.txt"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944422/; classtype:trojan-activity;sid:84807522; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944421)"; flow:established,from_client; content:"GET"; http_method; content:"/bleaty.toc"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"athuselevadores.com.br"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944421/; classtype:trojan-activity;sid:84807521; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944419)"; flow:established,from_client; content:"GET"; http_method; content:"/abjeyp"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"rough-truth-e072.publicftpresend.workers.dev"; http_host; depth:44; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944419/; classtype:trojan-activity;sid:84807519; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944420)"; flow:established,from_client; content:"GET"; http_method; content:"/anyname/img_140637.png"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"217.60.76.20"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944420/; classtype:trojan-activity;sid:84807520; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944418)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"105.224.5.39"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944418/; classtype:trojan-activity;sid:84807518; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944417)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.63.49.201"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944417/; classtype:trojan-activity;sid:84807517; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944416)"; flow:established,from_client; content:"GET"; http_method; content:"/armv6l"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"103.238.235.250"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944416/; classtype:trojan-activity;sid:84807516; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944412)"; flow:established,from_client; content:"GET"; http_method; content:"/sparc"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"103.238.235.250"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944412/; classtype:trojan-activity;sid:84807512; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944413)"; flow:established,from_client; content:"GET"; http_method; content:"/armv5l"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"103.238.235.250"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944413/; classtype:trojan-activity;sid:84807513; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944414)"; flow:established,from_client; content:"GET"; http_method; content:"/i586"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"103.238.235.250"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944414/; classtype:trojan-activity;sid:84807514; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944415)"; flow:established,from_client; content:"GET"; http_method; content:"/i686"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"103.238.235.250"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944415/; classtype:trojan-activity;sid:84807515; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944409)"; flow:established,from_client; content:"GET"; http_method; content:"/armv4l"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"103.238.235.250"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944409/; classtype:trojan-activity;sid:84807509; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944410)"; flow:established,from_client; content:"GET"; http_method; content:"/m68k"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"103.238.235.250"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944410/; classtype:trojan-activity;sid:84807510; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944411)"; flow:established,from_client; content:"GET"; http_method; content:"/powerpc"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"103.238.235.250"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944411/; classtype:trojan-activity;sid:84807511; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944408)"; flow:established,from_client; content:"GET"; http_method; content:"/img_233018.png"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"andbake.cam"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944408/; classtype:trojan-activity;sid:84807508; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944407)"; flow:established,from_client; content:"GET"; http_method; content:"/ohtmruw3"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"andbake.cam"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944407/; classtype:trojan-activity;sid:84807507; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944405)"; flow:established,from_client; content:"GET"; http_method; content:"/smpuvcjzd"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"rough-truth-e072.publicftpresend.workers.dev"; http_host; depth:44; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944405/; classtype:trojan-activity;sid:84807505; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944406)"; flow:established,from_client; content:"GET"; http_method; content:"/roybin.png"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"pub-37f3a615586d47f4996e932bf6df7670.r2.dev"; http_host; depth:43; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944406/; classtype:trojan-activity;sid:84807506; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944403)"; flow:established,from_client; content:"GET"; http_method; content:"/hzzgpvc7"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"andbake.cam"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944403/; classtype:trojan-activity;sid:84807503; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944404)"; flow:established,from_client; content:"GET"; http_method; content:"/img_233158.png"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"andbake.cam"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944404/; classtype:trojan-activity;sid:84807504; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944402)"; flow:established,from_client; content:"GET"; http_method; content:"/img_060214.png"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"sandybeachesandsunsets.com"; http_host; depth:26; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944402/; classtype:trojan-activity;sid:84807502; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944401)"; flow:established,from_client; content:"GET"; http_method; content:"/img_120922.png"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"fibernetperu.pe"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944401/; classtype:trojan-activity;sid:84807501; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944400)"; flow:established,from_client; content:"GET"; http_method; content:"/dprtpu55"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"fibernetperu.pe"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944400/; classtype:trojan-activity;sid:84807500; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944399)"; flow:established,from_client; content:"GET"; http_method; content:"/img_033922.png"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"sugarfreedcup.co.za"; http_host; depth:19; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944399/; classtype:trojan-activity;sid:84807499; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944398)"; flow:established,from_client; content:"GET"; http_method; content:"/file/img_154255.png"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"wp.fujeigroup.com"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944398/; classtype:trojan-activity;sid:84807498; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944397)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.54.110.21"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944397/; classtype:trojan-activity;sid:84807497; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944396)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"59.97.253.220"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944396/; classtype:trojan-activity;sid:84807496; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944394)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"110.138.1.45"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944394/; classtype:trojan-activity;sid:84807494; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944395)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"39.87.126.131"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944395/; classtype:trojan-activity;sid:84807495; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944393)"; flow:established,from_client; content:"GET"; http_method; content:"/nnnnnnzeeee/secured_stub.ps1"; http_uri; depth:29; isdataat:!1,relative; nocase; content:"flocmaterials.shop"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944393/; classtype:trojan-activity;sid:84807493; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944392)"; flow:established,from_client; content:"GET"; http_method; content:"/img_035907.png"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"sugarfreedcup.co.za"; http_host; depth:19; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944392/; classtype:trojan-activity;sid:84807492; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944391)"; flow:established,from_client; content:"GET"; http_method; content:"/masabbikk/secured_stub.ps1"; http_uri; depth:27; isdataat:!1,relative; nocase; content:"aksiyononline.best"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944391/; classtype:trojan-activity;sid:84807491; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944390)"; flow:established,from_client; content:"GET"; http_method; content:"/telnetbins.sh"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"103.238.235.250"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944390/; classtype:trojan-activity;sid:84807490; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944386)"; flow:established,from_client; content:"GET"; http_method; content:"/x86"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"103.238.235.250"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944386/; classtype:trojan-activity;sid:84807486; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944387)"; flow:established,from_client; content:"GET"; http_method; content:"/mips"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"103.238.235.250"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944387/; classtype:trojan-activity;sid:84807487; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944388)"; flow:established,from_client; content:"GET"; http_method; content:"/sh4"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"103.238.235.250"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944388/; classtype:trojan-activity;sid:84807488; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944389)"; flow:established,from_client; content:"GET"; http_method; content:"/mipsel"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"103.238.235.250"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944389/; classtype:trojan-activity;sid:84807489; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944385)"; flow:established,from_client; content:"GET"; http_method; content:"/4.jpg"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"31.40.204.114"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944385/; classtype:trojan-activity;sid:84807485; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944383)"; flow:established,from_client; content:"GET"; http_method; content:"/file/mccppcs.txt"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"nd.tdpqnf.com"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944383/; classtype:trojan-activity;sid:84807483; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944384)"; flow:established,from_client; content:"GET"; http_method; content:"/img/1.jpg"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"107.172.206.125"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944384/; classtype:trojan-activity;sid:84807484; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944382)"; flow:established,from_client; content:"GET"; http_method; content:"/file/jpesoai.txt"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"nd.tdpqnf.com"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944382/; classtype:trojan-activity;sid:84807482; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944380)"; flow:established,from_client; content:"GET"; http_method; content:"/sma/mnpckbo.txt"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"nd.tdpqnf.com"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944380/; classtype:trojan-activity;sid:84807480; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944381)"; flow:established,from_client; content:"GET"; http_method; content:"/fiipisf.txt"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"31.40.204.114"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944381/; classtype:trojan-activity;sid:84807481; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944379)"; flow:established,from_client; content:"GET"; http_method; content:"/1.jpg"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"31.40.204.114"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944379/; classtype:trojan-activity;sid:84807479; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944377)"; flow:established,from_client; content:"GET"; http_method; content:"/55/wegoodforme.hta"; http_uri; depth:19; isdataat:!1,relative; nocase; content:"107.172.206.125"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944377/; classtype:trojan-activity;sid:84807477; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944378)"; flow:established,from_client; content:"GET"; http_method; content:"/60/wegivenbestthignswithme.hta"; http_uri; depth:31; isdataat:!1,relative; nocase; content:"107.172.206.125"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944378/; classtype:trojan-activity;sid:84807478; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944376)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.57.40.143"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944376/; classtype:trojan-activity;sid:84807476; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944375)"; flow:established,from_client; content:"GET"; http_method; content:"/download/windowsupdate.ps1"; http_uri; depth:27; isdataat:!1,relative; nocase; content:"hardly-signatures-loc-surf.trycloudflare.com"; http_host; depth:44; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944375/; classtype:trojan-activity;sid:84807475; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944374)"; flow:established,from_client; content:"GET"; http_method; content:"/60/aakdhfi.txt"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"107.173.143.44"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944374/; classtype:trojan-activity;sid:84807474; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944372)"; flow:established,from_client; content:"GET"; http_method; content:"/img/1.jpg"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"64.224.17.115"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944372/; classtype:trojan-activity;sid:84807472; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944373)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"180.243.51.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944373/; classtype:trojan-activity;sid:84807473; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944362)"; flow:established,from_client; content:"GET"; http_method; content:"/fjvdaefanrcpqhxrqgrdi146.bin"; http_uri; depth:29; isdataat:!1,relative; nocase; content:"194.116.236.88"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944362/; classtype:trojan-activity;sid:84807462; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944363)"; flow:established,from_client; content:"GET"; http_method; content:"/yuvlizwyol185.bin"; http_uri; depth:18; isdataat:!1,relative; nocase; content:"194.116.236.88"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944363/; classtype:trojan-activity;sid:84807463; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944364)"; flow:established,from_client; content:"GET"; http_method; content:"/vlgprxhpuqegj205.bin"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"194.116.236.88"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944364/; classtype:trojan-activity;sid:84807464; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944365)"; flow:established,from_client; content:"GET"; http_method; content:"/snderjyskens.hhk"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"194.116.236.88"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944365/; classtype:trojan-activity;sid:84807465; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944366)"; flow:established,from_client; content:"GET"; http_method; content:"/mavede.asd"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"194.116.236.88"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944366/; classtype:trojan-activity;sid:84807466; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944367)"; flow:established,from_client; content:"GET"; http_method; content:"/pereia.dsp"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"194.116.236.88"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944367/; classtype:trojan-activity;sid:84807467; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944368)"; flow:established,from_client; content:"GET"; http_method; content:"/bothilde.mdp"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"194.116.236.88"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944368/; classtype:trojan-activity;sid:84807468; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944369)"; flow:established,from_client; content:"GET"; http_method; content:"/wiimgn142.bin"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"194.116.236.88"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944369/; classtype:trojan-activity;sid:84807469; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944370)"; flow:established,from_client; content:"GET"; http_method; content:"/aitptsjhq176.bin"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"194.116.236.88"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944370/; classtype:trojan-activity;sid:84807470; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944371)"; flow:established,from_client; content:"GET"; http_method; content:"/jernholdiges.asi"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"194.116.236.88"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944371/; classtype:trojan-activity;sid:84807471; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944361)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"112.225.100.68"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944361/; classtype:trojan-activity;sid:84807461; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944359)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"39.46.175.163"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944359/; classtype:trojan-activity;sid:84807459; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944360)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.57.87.38"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944360/; classtype:trojan-activity;sid:84807460; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944358)"; flow:established,from_client; content:"GET"; http_method; content:"/d.exe"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"192.162.199.159"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944358/; classtype:trojan-activity;sid:84807458; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944357)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"220.198.113.61"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944357/; classtype:trojan-activity;sid:84807457; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944356)"; flow:established,from_client; content:"GET"; http_method; content:"/update.ps1"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"45.137.201.81"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944356/; classtype:trojan-activity;sid:84807456; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944355)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.14.152.208"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944355/; classtype:trojan-activity;sid:84807455; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944354)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.136.85.234"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944354/; classtype:trojan-activity;sid:84807454; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944353)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.59.88.197"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944353/; classtype:trojan-activity;sid:84807453; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944349)"; flow:established,from_client; content:"GET"; http_method; content:"/yarn"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"101.99.95.124"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944349/; classtype:trojan-activity;sid:84807449; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944350)"; flow:established,from_client; content:"GET"; http_method; content:"/pay"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"101.99.95.124"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944350/; classtype:trojan-activity;sid:84807450; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944351)"; flow:established,from_client; content:"GET"; http_method; content:"/sora.sh"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"101.99.95.124"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944351/; classtype:trojan-activity;sid:84807451; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944352)"; flow:established,from_client; content:"GET"; http_method; content:"/bin"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"101.99.95.124"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944352/; classtype:trojan-activity;sid:84807452; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944348)"; flow:established,from_client; content:"GET"; http_method; content:"/5r3fqt67ew531has4231.x86"; http_uri; depth:25; isdataat:!1,relative; nocase; content:"144.31.150.183"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944348/; classtype:trojan-activity;sid:84807448; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944347)"; flow:established,from_client; content:"GET"; http_method; content:"/5r3fqt67ew531has4231.arm6"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"144.31.150.183"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944347/; classtype:trojan-activity;sid:84807447; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944344)"; flow:established,from_client; content:"GET"; http_method; content:"/5r3fqt67ew531has4231.arm7"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"144.31.150.183"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944344/; classtype:trojan-activity;sid:84807444; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944345)"; flow:established,from_client; content:"GET"; http_method; content:"/5r3fqt67ew531has4231.mpsl"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"144.31.150.183"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944345/; classtype:trojan-activity;sid:84807445; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944346)"; flow:established,from_client; content:"GET"; http_method; content:"/5r3fqt67ew531has4231.arm5"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"144.31.150.183"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944346/; classtype:trojan-activity;sid:84807446; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944343)"; flow:established,from_client; content:"GET"; http_method; content:"/exp.so"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"23.254.195.48"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944343/; classtype:trojan-activity;sid:84807443; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944339)"; flow:established,from_client; content:"GET"; http_method; content:"/dlr.ppc"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"104.168.4.206"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944339/; classtype:trojan-activity;sid:84807439; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944340)"; flow:established,from_client; content:"GET"; http_method; content:"/dlr.arm7"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"104.168.4.206"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944340/; classtype:trojan-activity;sid:84807440; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944341)"; flow:established,from_client; content:"GET"; http_method; content:"/dlr.mips"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"104.168.4.206"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944341/; classtype:trojan-activity;sid:84807441; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944342)"; flow:established,from_client; content:"GET"; http_method; content:"/disspoor"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"104.168.4.206"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944342/; classtype:trojan-activity;sid:84807442; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944333)"; flow:established,from_client; content:"GET"; http_method; content:"/dlr.arm"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"104.168.4.206"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944333/; classtype:trojan-activity;sid:84807433; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944334)"; flow:established,from_client; content:"GET"; http_method; content:"/dlr.mpsl"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"104.168.4.206"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944334/; classtype:trojan-activity;sid:84807434; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944335)"; flow:established,from_client; content:"GET"; http_method; content:"/dlr.x86"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"104.168.4.206"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944335/; classtype:trojan-activity;sid:84807435; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944336)"; flow:established,from_client; content:"GET"; http_method; content:"/dlr.arm6"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"104.168.4.206"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944336/; classtype:trojan-activity;sid:84807436; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944337)"; flow:established,from_client; content:"GET"; http_method; content:"/dlr.arm5"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"104.168.4.206"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944337/; classtype:trojan-activity;sid:84807437; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944338)"; flow:established,from_client; content:"GET"; http_method; content:"/dlr.sh4"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"104.168.4.206"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944338/; classtype:trojan-activity;sid:84807438; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944331)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"103.111.23.13"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944331/; classtype:trojan-activity;sid:84807431; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944332)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.52.20.56"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944332/; classtype:trojan-activity;sid:84807432; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944330)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.55.192.235"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944330/; classtype:trojan-activity;sid:84807430; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944329)"; flow:established,from_client; content:"GET"; http_method; content:"/e"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"176.65.139.36"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944329/; classtype:trojan-activity;sid:84807429; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944328)"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content/themes/classic/sevv.ps1"; http_uri; depth:35; isdataat:!1,relative; nocase; content:"severidades.cfd"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944328/; classtype:trojan-activity;sid:84807428; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944326)"; flow:established,from_client; content:"GET"; http_method; content:"/bin/support.client.exe"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"124.198.131.75"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944326/; classtype:trojan-activity;sid:84807426; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944327)"; flow:established,from_client; content:"GET"; http_method; content:"/bin/screenconnect.clientsetup.exe"; http_uri; depth:34; isdataat:!1,relative; nocase; content:"124.198.131.75"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944327/; classtype:trojan-activity;sid:84807427; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944325)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"171.81.95.244"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944325/; classtype:trojan-activity;sid:84807425; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944324)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.59.112.10"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944324/; classtype:trojan-activity;sid:84807424; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944318)"; flow:established,from_client; content:"GET"; http_method; content:"/unrealclient-3.0.2-obf.jar"; http_uri; depth:27; isdataat:!1,relative; nocase; content:"unrealclient.pages.dev"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944318/; classtype:trojan-activity;sid:84807418; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944319)"; flow:established,from_client; content:"GET"; http_method; content:"/loader2-4.zip"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"loader2-4.github.io"; http_host; depth:19; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944319/; classtype:trojan-activity;sid:84807419; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944320)"; flow:established,from_client; content:"GET"; http_method; content:"/stub.ps1"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"124.198.132.250"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944320/; classtype:trojan-activity;sid:84807420; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944321)"; flow:established,from_client; content:"GET"; http_method; content:"/wrb.ps1"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"124.198.132.250"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944321/; classtype:trojan-activity;sid:84807421; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944322)"; flow:established,from_client; content:"GET"; http_method; content:"/raw1.ps1"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"124.198.132.250"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944322/; classtype:trojan-activity;sid:84807422; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944323)"; flow:established,from_client; content:"GET"; http_method; content:"/printspoofer64.exe"; http_uri; depth:19; isdataat:!1,relative; nocase; content:"124.198.132.250"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944323/; classtype:trojan-activity;sid:84807423; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944317)"; flow:established,from_client; content:"GET"; http_method; content:"/bin/manta.arc"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"176.65.139.229"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944317/; classtype:trojan-activity;sid:84807417; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944315)"; flow:established,from_client; content:"GET"; http_method; content:"/bin/manta.mipsel"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"176.65.139.229"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944315/; classtype:trojan-activity;sid:84807415; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944316)"; flow:established,from_client; content:"GET"; http_method; content:"/bin/manta.sh4"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"176.65.139.229"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944316/; classtype:trojan-activity;sid:84807416; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944307)"; flow:established,from_client; content:"GET"; http_method; content:"/bin/manta.m68k"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"176.65.139.229"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944307/; classtype:trojan-activity;sid:84807407; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944308)"; flow:established,from_client; content:"GET"; http_method; content:"/bin/manta.ppc"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"176.65.139.229"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944308/; classtype:trojan-activity;sid:84807408; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944309)"; flow:established,from_client; content:"GET"; http_method; content:"/bin/manta.i686"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"176.65.139.229"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944309/; classtype:trojan-activity;sid:84807409; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944310)"; flow:established,from_client; content:"GET"; http_method; content:"/bin/manta.mips"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"176.65.139.229"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944310/; classtype:trojan-activity;sid:84807410; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944311)"; flow:established,from_client; content:"GET"; http_method; content:"/bin/manta.armv7l"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"176.65.139.229"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944311/; classtype:trojan-activity;sid:84807411; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944312)"; flow:established,from_client; content:"GET"; http_method; content:"/bin/manta.armv6l"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"176.65.139.229"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944312/; classtype:trojan-activity;sid:84807412; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944313)"; flow:established,from_client; content:"GET"; http_method; content:"/bin/manta.aarch64"; http_uri; depth:18; isdataat:!1,relative; nocase; content:"176.65.139.229"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944313/; classtype:trojan-activity;sid:84807413; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944314)"; flow:established,from_client; content:"GET"; http_method; content:"/bin/manta.x86_64"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"176.65.139.229"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944314/; classtype:trojan-activity;sid:84807414; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944306)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.mips"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"101.99.95.124"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944306/; classtype:trojan-activity;sid:84807406; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944304)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.x86"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"101.99.95.124"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944304/; classtype:trojan-activity;sid:84807404; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944305)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.arm6"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"101.99.95.124"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944305/; classtype:trojan-activity;sid:84807405; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944296)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.mpsl"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"101.99.95.124"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944296/; classtype:trojan-activity;sid:84807396; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944297)"; flow:established,from_client; content:"GET"; http_method; content:"/tadashi.arm7"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"13.140.176.180"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944297/; classtype:trojan-activity;sid:84807397; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944298)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.m68k"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"101.99.95.124"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944298/; classtype:trojan-activity;sid:84807398; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944299)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.sh4"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"101.99.95.124"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944299/; classtype:trojan-activity;sid:84807399; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944300)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.ppc"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"101.99.95.124"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944300/; classtype:trojan-activity;sid:84807400; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944301)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.arm7"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"101.99.95.124"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944301/; classtype:trojan-activity;sid:84807401; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944302)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.arm4"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"101.99.95.124"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944302/; classtype:trojan-activity;sid:84807402; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944303)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/sora.arm5"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"101.99.95.124"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944303/; classtype:trojan-activity;sid:84807403; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944295)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.118.189.126"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944295/; classtype:trojan-activity;sid:84807395; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944294)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.57.65.207"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944294/; classtype:trojan-activity;sid:84807394; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944293)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.28.189.218"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944293/; classtype:trojan-activity;sid:84807393; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944292)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"45.172.218.181"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944292/; classtype:trojan-activity;sid:84807392; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944291)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.177.199.73"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944291/; classtype:trojan-activity;sid:84807391; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944290)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"130.0.33.104"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944290/; classtype:trojan-activity;sid:84807390; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944289)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"114.227.84.84"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944289/; classtype:trojan-activity;sid:84807389; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944287)"; flow:established,from_client; content:"GET"; http_method; content:"/33/wetrongiven.js"; http_uri; depth:18; isdataat:!1,relative; nocase; content:"107.175.88.71"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944287/; classtype:trojan-activity;sid:84807387; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944288)"; flow:established,from_client; content:"GET"; http_method; content:"/33/img_182647.png"; http_uri; depth:18; isdataat:!1,relative; nocase; content:"107.175.88.71"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944288/; classtype:trojan-activity;sid:84807388; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944286)"; flow:established,from_client; content:"GET"; http_method; content:"/33/brodaron.hta"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"107.175.88.71"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944286/; classtype:trojan-activity;sid:84807386; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944285)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.203.183.158"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944285/; classtype:trojan-activity;sid:84807385; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944274)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.172.78.134"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944274/; classtype:trojan-activity;sid:84807374; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944275)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.45.17.175"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944275/; classtype:trojan-activity;sid:84807375; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944276)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"78.25.126.68"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944276/; classtype:trojan-activity;sid:84807376; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944277)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.57.15.111"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944277/; classtype:trojan-activity;sid:84807377; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944278)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"130.0.33.104"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944278/; classtype:trojan-activity;sid:84807378; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944279)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.224.83.188"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944279/; classtype:trojan-activity;sid:84807379; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944280)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.224.60.120"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944280/; classtype:trojan-activity;sid:84807380; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944281)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.112.1.67"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944281/; classtype:trojan-activity;sid:84807381; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944282)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.55.192.235"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944282/; classtype:trojan-activity;sid:84807382; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944283)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"110.138.1.45"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944283/; classtype:trojan-activity;sid:84807383; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944284)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.44.147.214"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944284/; classtype:trojan-activity;sid:84807384; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944266)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.23.232.109"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944266/; classtype:trojan-activity;sid:84807366; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944267)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"185.147.40.109"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944267/; classtype:trojan-activity;sid:84807367; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944268)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.235.48.74"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944268/; classtype:trojan-activity;sid:84807368; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944269)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.118.245.201"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944269/; classtype:trojan-activity;sid:84807369; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944270)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"121.202.142.137"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944270/; classtype:trojan-activity;sid:84807370; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944271)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"188.38.158.163"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944271/; classtype:trojan-activity;sid:84807371; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944272)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.234.233.75"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944272/; classtype:trojan-activity;sid:84807372; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944273)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"61.53.83.129"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944273/; classtype:trojan-activity;sid:84807373; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944265)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"120.28.189.218"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944265/; classtype:trojan-activity;sid:84807365; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944264)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.57.255.84"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944264/; classtype:trojan-activity;sid:84807364; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944263)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.99.255.81"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944263/; classtype:trojan-activity;sid:84807363; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944262)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.237.34.84"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944262/; classtype:trojan-activity;sid:84807362; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944256)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.43.32.223"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944256/; classtype:trojan-activity;sid:84807356; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944257)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"170.84.133.235"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944257/; classtype:trojan-activity;sid:84807357; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944258)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.127.53.189"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944258/; classtype:trojan-activity;sid:84807358; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944259)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"109.194.28.77"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944259/; classtype:trojan-activity;sid:84807359; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944260)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"85.140.44.96"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944260/; classtype:trojan-activity;sid:84807360; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944261)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.58.177.21"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944261/; classtype:trojan-activity;sid:84807361; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944255)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"108.168.10.70"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944255/; classtype:trojan-activity;sid:84807355; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944253)"; flow:established,from_client; content:"GET"; http_method; content:"/5r3fqt67ew531has4231.mips"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"144.31.150.183"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944253/; classtype:trojan-activity;sid:84807353; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944254)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.m"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"185.82.64.55"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944254/; classtype:trojan-activity;sid:84807354; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944252)"; flow:established,from_client; content:"GET"; http_method; content:"/downloads/aetherius-1.8.2.jar"; http_uri; depth:30; isdataat:!1,relative; nocase; content:"aetherius.live"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944252/; classtype:trojan-activity;sid:84807352; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944251)"; flow:established,from_client; content:"GET"; http_method; content:"/hashmanager.zip"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"growgreenhorizons.com"; http_host; depth:21; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944251/; classtype:trojan-activity;sid:84807351; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944250)"; flow:established,from_client; content:"GET"; http_method; content:"/download/vlpjvpm4cqk"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"f74.workupload.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944250/; classtype:trojan-activity;sid:84807350; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944249)"; flow:established,from_client; content:"GET"; http_method; content:"/files-129312398/files/file_6090c1ecb2a975aa.exe"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"91.92.242.236"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944249/; classtype:trojan-activity;sid:84807349; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944247)"; flow:established,from_client; content:"GET"; http_method; content:"/bx_arm64.p"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"23.254.195.48"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944247/; classtype:trojan-activity;sid:84807347; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944248)"; flow:established,from_client; content:"GET"; http_method; content:"/bx_mips.p"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"23.254.195.48"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944248/; classtype:trojan-activity;sid:84807348; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944246)"; flow:established,from_client; content:"GET"; http_method; content:"/f/m/.b0s_x86_64"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"130.12.182.19"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944246/; classtype:trojan-activity;sid:84807346; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944244)"; flow:established,from_client; content:"GET"; http_method; content:"/kabot/mig-logcleaner-resurrected.git"; http_uri; depth:37; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944244/; classtype:trojan-activity;sid:84807344; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944245)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.m"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.173.123.251"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944245/; classtype:trojan-activity;sid:84807345; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944243)"; flow:established,from_client; content:"GET"; http_method; content:"/30/bestwishesgivenmebesttings.hta|3f|pic_4995459495.jpg"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"216.9.224.45"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944243/; classtype:trojan-activity;sid:84807343; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944242)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.167.87.144"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944242/; classtype:trojan-activity;sid:84807342; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944241)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"218.16.164.137"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944241/; classtype:trojan-activity;sid:84807341; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944240)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.230.40.218"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944240/; classtype:trojan-activity;sid:84807340; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944239)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"112.238.27.166"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944239/; classtype:trojan-activity;sid:84807339; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944238)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"112.228.200.135"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944238/; classtype:trojan-activity;sid:84807338; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944237)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"219.157.176.43"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944237/; classtype:trojan-activity;sid:84807337; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944235)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"202.110.9.54"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944235/; classtype:trojan-activity;sid:84807335; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944236)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.46.198.140"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944236/; classtype:trojan-activity;sid:84807336; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944232)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"201.110.189.61"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944232/; classtype:trojan-activity;sid:84807332; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944233)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"14.221.238.62"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944233/; classtype:trojan-activity;sid:84807333; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944234)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"210.208.110.51"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944234/; classtype:trojan-activity;sid:84807334; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944231)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"180.107.78.120"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944231/; classtype:trojan-activity;sid:84807331; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944229)"; flow:established,from_client; content:"GET"; http_method; content:"/30/img_224029.png"; http_uri; depth:18; isdataat:!1,relative; nocase; content:"216.9.224.45"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944229/; classtype:trojan-activity;sid:84807329; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944230)"; flow:established,from_client; content:"GET"; http_method; content:"/30/greenangelkings.js"; http_uri; depth:22; isdataat:!1,relative; nocase; content:"216.9.224.45"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944230/; classtype:trojan-activity;sid:84807330; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944227)"; flow:established,from_client; content:"GET"; http_method; content:"/30/bestwishesgivenmebesttings.hta"; http_uri; depth:34; isdataat:!1,relative; nocase; content:"216.9.224.45"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944227/; classtype:trojan-activity;sid:84807327; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944228)"; flow:established,from_client; content:"GET"; http_method; content:"/ips.py"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"deffnelreports.bramblequarz.ru"; http_host; depth:30; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944228/; classtype:trojan-activity;sid:84807328; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944226)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.18.58.38"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944226/; classtype:trojan-activity;sid:84807326; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944225)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"165.98.243.83"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944225/; classtype:trojan-activity;sid:84807325; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944222)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"58.47.106.128"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944222/; classtype:trojan-activity;sid:84807322; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944223)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.55.194.104"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944223/; classtype:trojan-activity;sid:84807323; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944224)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.43.173.18"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944224/; classtype:trojan-activity;sid:84807324; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944221)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.50.235.154"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944221/; classtype:trojan-activity;sid:84807321; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944220)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.224.5.39"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944220/; classtype:trojan-activity;sid:84807320; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944219)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.114.195.5"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944219/; classtype:trojan-activity;sid:84807319; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944215)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"119.179.237.222"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944215/; classtype:trojan-activity;sid:84807315; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944216)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.63.49.201"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944216/; classtype:trojan-activity;sid:84807316; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944217)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.11.234.79"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944217/; classtype:trojan-activity;sid:84807317; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944218)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"171.81.95.244"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944218/; classtype:trojan-activity;sid:84807318; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944214)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.114.195.5"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944214/; classtype:trojan-activity;sid:84807314; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944213)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.28.193.113"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944213/; classtype:trojan-activity;sid:84807313; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944212)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.63.144.176"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944212/; classtype:trojan-activity;sid:84807312; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944208)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.44.145.227"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944208/; classtype:trojan-activity;sid:84807308; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944209)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"112.248.141.165"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944209/; classtype:trojan-activity;sid:84807309; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944210)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"36.88.136.194"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944210/; classtype:trojan-activity;sid:84807310; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944211)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.44.145.227"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944211/; classtype:trojan-activity;sid:84807311; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944206)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"37.52.180.238"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944206/; classtype:trojan-activity;sid:84807306; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944207)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"116.139.99.176"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944207/; classtype:trojan-activity;sid:84807307; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944205)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.215.181.136"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944205/; classtype:trojan-activity;sid:84807305; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944204)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.180.159.171"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944204/; classtype:trojan-activity;sid:84807304; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944203)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"112.248.141.165"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944203/; classtype:trojan-activity;sid:84807303; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944202)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.191.104.3"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944202/; classtype:trojan-activity;sid:84807302; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944201)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.15.179.180"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944201/; classtype:trojan-activity;sid:84807301; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944200)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"116.55.2.151"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944200/; classtype:trojan-activity;sid:84807300; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944198)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.14.86.235"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944198/; classtype:trojan-activity;sid:84807298; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944199)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.134.173.157"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944199/; classtype:trojan-activity;sid:84807299; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944185)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.165.81.126"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944185/; classtype:trojan-activity;sid:84807285; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944186)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"116.139.99.176"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944186/; classtype:trojan-activity;sid:84807286; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944187)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.220.213.206"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944187/; classtype:trojan-activity;sid:84807287; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944188)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.246.108.59"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944188/; classtype:trojan-activity;sid:84807288; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944189)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"210.208.110.51"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944189/; classtype:trojan-activity;sid:84807289; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944190)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.238.229.213"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944190/; classtype:trojan-activity;sid:84807290; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944191)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"5.26.131.236"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944191/; classtype:trojan-activity;sid:84807291; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944192)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.121.179.96"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944192/; classtype:trojan-activity;sid:84807292; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944193)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.84.215.208"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944193/; classtype:trojan-activity;sid:84807293; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944194)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.53.72.71"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944194/; classtype:trojan-activity;sid:84807294; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944195)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.157.176.43"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944195/; classtype:trojan-activity;sid:84807295; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944196)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.227.133.167"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944196/; classtype:trojan-activity;sid:84807296; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944197)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.11.234.79"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944197/; classtype:trojan-activity;sid:84807297; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944184)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.165.82.32"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944184/; classtype:trojan-activity;sid:84807284; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944183)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"112.248.113.232"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944183/; classtype:trojan-activity;sid:84807283; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944182)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"37.52.180.238"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944182/; classtype:trojan-activity;sid:84807282; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944181)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"95.15.69.204"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944181/; classtype:trojan-activity;sid:84807281; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944178)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.139.36.194"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944178/; classtype:trojan-activity;sid:84807278; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944179)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"39.87.126.131"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944179/; classtype:trojan-activity;sid:84807279; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944180)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.63.78.29"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944180/; classtype:trojan-activity;sid:84807280; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944177)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.189.69.192"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944177/; classtype:trojan-activity;sid:84807277; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944176)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"103.179.240.227"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944176/; classtype:trojan-activity;sid:84807276; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944175)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"112.248.113.232"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944175/; classtype:trojan-activity;sid:84807275; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944174)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"103.179.240.227"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944174/; classtype:trojan-activity;sid:84807274; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944173)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.161.1.232"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944173/; classtype:trojan-activity;sid:84807273; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944172)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.113.6.188"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944172/; classtype:trojan-activity;sid:84807272; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944170)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.63.51.182"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944170/; classtype:trojan-activity;sid:84807270; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944171)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"180.191.40.108"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944171/; classtype:trojan-activity;sid:84807271; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944169)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"41.216.227.66"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944169/; classtype:trojan-activity;sid:84807269; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944167)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"45.172.218.181"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944167/; classtype:trojan-activity;sid:84807267; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944168)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"180.245.56.243"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944168/; classtype:trojan-activity;sid:84807268; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944165)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.165.87.230"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944165/; classtype:trojan-activity;sid:84807265; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944166)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"114.227.65.175"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944166/; classtype:trojan-activity;sid:84807266; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944164)"; flow:established,from_client; content:"GET"; http_method; content:"/bx_amd64.p"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"23.254.195.48"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944164/; classtype:trojan-activity;sid:84807264; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944163)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"112.248.101.66"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944163/; classtype:trojan-activity;sid:84807263; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944162)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.179.237.222"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944162/; classtype:trojan-activity;sid:84807262; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944158)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.165.87.230"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944158/; classtype:trojan-activity;sid:84807258; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944159)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"14.221.238.62"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944159/; classtype:trojan-activity;sid:84807259; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944160)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"180.245.56.243"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944160/; classtype:trojan-activity;sid:84807260; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944161)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"114.227.65.175"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944161/; classtype:trojan-activity;sid:84807261; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944156)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.189.96.59"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944156/; classtype:trojan-activity;sid:84807256; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944157)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.12.20.207"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944157/; classtype:trojan-activity;sid:84807257; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944155)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.12.20.207"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944155/; classtype:trojan-activity;sid:84807255; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944154)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.124.121.111"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944154/; classtype:trojan-activity;sid:84807254; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944152)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.138.151.54"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944152/; classtype:trojan-activity;sid:84807252; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944153)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.220.213.206"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944153/; classtype:trojan-activity;sid:84807253; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944150)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.53.83.129"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944150/; classtype:trojan-activity;sid:84807250; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944151)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.40.158.189"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944151/; classtype:trojan-activity;sid:84807251; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944147)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"138.204.196.254"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944147/; classtype:trojan-activity;sid:84807247; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944148)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.147.200.123"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944148/; classtype:trojan-activity;sid:84807248; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944149)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.165.82.246"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944149/; classtype:trojan-activity;sid:84807249; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944145)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"37.26.86.216"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944145/; classtype:trojan-activity;sid:84807245; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944146)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.50.216.143"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944146/; classtype:trojan-activity;sid:84807246; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944143)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.40.158.189"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944143/; classtype:trojan-activity;sid:84807243; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944144)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.224.249.40"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944144/; classtype:trojan-activity;sid:84807244; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944141)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.202.234.182"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944141/; classtype:trojan-activity;sid:84807241; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944142)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.114.34.128"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944142/; classtype:trojan-activity;sid:84807242; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944139)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"37.26.86.216"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944139/; classtype:trojan-activity;sid:84807239; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944140)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.86.117.7"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944140/; classtype:trojan-activity;sid:84807240; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944138)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"202.1.26.13"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944138/; classtype:trojan-activity;sid:84807238; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944136)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.221.14.251"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944136/; classtype:trojan-activity;sid:84807236; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944137)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"59.97.252.95"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944137/; classtype:trojan-activity;sid:84807237; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944135)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.147.94.199"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944135/; classtype:trojan-activity;sid:84807235; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944134)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.16.135.182"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944134/; classtype:trojan-activity;sid:84807234; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944132)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.9.200.156"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944132/; classtype:trojan-activity;sid:84807232; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944133)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.187.197.115"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944133/; classtype:trojan-activity;sid:84807233; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944131)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"95.9.35.137"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944131/; classtype:trojan-activity;sid:84807231; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944130)"; flow:established,from_client; content:"GET"; http_method; content:"/totemcounter-26.2.jar"; http_uri; depth:22; isdataat:!1,relative; nocase; content:"donutclients.st"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944130/; classtype:trojan-activity;sid:84807230; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944128)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"154.242.13.34"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944128/; classtype:trojan-activity;sid:84807228; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944129)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.62.186.251"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944129/; classtype:trojan-activity;sid:84807229; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944127)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.55.229.99"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944127/; classtype:trojan-activity;sid:84807227; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944126)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"185.89.156.101"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944126/; classtype:trojan-activity;sid:84807226; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944125)"; flow:established,from_client; content:"GET"; http_method; content:"/scl/fi/jnf0ecydm1z63frnge1mn/docsend.exe|3f|rlkey=01seodht5j6nnix645ejn3a5r|7c|26|7c|st=vcdaxsj2|7c|26|7c|dl=1"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"www.dropbox.com"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944125/; classtype:trojan-activity;sid:84807225; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944124)"; flow:established,from_client; content:"GET"; http_method; content:"/scl/fi/dcbo57pem0pjqzx65giot/matefalls-setup-1.0.0.exe|3f|rlkey=yc7kc4vm6iy1urr0wh1xwta91|7c|26|7c|dl=1"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"www.dropbox.com"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944124/; classtype:trojan-activity;sid:84807224; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944123)"; flow:established,from_client; content:"GET"; http_method; content:"/wps_setup_x64.zip"; http_uri; depth:18; isdataat:!1,relative; nocase; content:"xiazailianjie.com"; http_host; depth:17; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944123/; classtype:trojan-activity;sid:84807223; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944122)"; flow:established,from_client; content:"GET"; http_method; content:"/scl/fi/jwhb6vojim0cfxrxip9fk/docsend.exe|3f|rlkey=zgpwwjbtsrnatafb9g24pjnxu|7c|26|7c|st=gwds3ryx|7c|26|7c|dl=1"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"www.dropbox.com"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944122/; classtype:trojan-activity;sid:84807222; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944121)"; flow:established,from_client; content:"GET"; http_method; content:"/2026scrill/client.jar"; http_uri; depth:22; isdataat:!1,relative; nocase; content:"stellaspicy.org"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944121/; classtype:trojan-activity;sid:84807221; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944114)"; flow:established,from_client; content:"GET"; http_method; content:"/beacon_x"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"23.254.195.48"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944114/; classtype:trojan-activity;sid:84807214; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944115)"; flow:established,from_client; content:"GET"; http_method; content:"/donutdupe-26.2.jar"; http_uri; depth:19; isdataat:!1,relative; nocase; content:"donutdupe.com"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944115/; classtype:trojan-activity;sid:84807215; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944116)"; flow:established,from_client; content:"GET"; http_method; content:"/2026scrill/runelite.exe"; http_uri; depth:24; isdataat:!1,relative; nocase; content:"stellaspicy.org"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944116/; classtype:trojan-activity;sid:84807216; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944117)"; flow:established,from_client; content:"GET"; http_method; content:"/krypton-client-26.2.jar"; http_uri; depth:24; isdataat:!1,relative; nocase; content:"donutclients.st"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944117/; classtype:trojan-activity;sid:84807217; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944118)"; flow:established,from_client; content:"GET"; http_method; content:"/radium-client-26.2.jar"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"donutclients.st"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944118/; classtype:trojan-activity;sid:84807218; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944119)"; flow:established,from_client; content:"GET"; http_method; content:"/shulker_box_tooltip-26.2.jar"; http_uri; depth:29; isdataat:!1,relative; nocase; content:"donutclients.st"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944119/; classtype:trojan-activity;sid:84807219; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944120)"; flow:established,from_client; content:"GET"; http_method; content:"/alycone-client-26.2.jar"; http_uri; depth:24; isdataat:!1,relative; nocase; content:"donutclients.st"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944120/; classtype:trojan-activity;sid:84807220; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944113)"; flow:established,from_client; content:"GET"; http_method; content:"/gamble-rig-26.2.jar"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"donutclients.st"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944113/; classtype:trojan-activity;sid:84807213; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944112)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.m"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.121.16.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944112/; classtype:trojan-activity;sid:84807212; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944111)"; flow:established,from_client; content:"GET"; http_method; content:"/radon-client-26.2.jar"; http_uri; depth:22; isdataat:!1,relative; nocase; content:"donutclients.st"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944111/; classtype:trojan-activity;sid:84807211; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944110)"; flow:established,from_client; content:"GET"; http_method; content:"/glazed-client-26.2.jar"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"donutclients.st"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944110/; classtype:trojan-activity;sid:84807210; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944107)"; flow:established,from_client; content:"GET"; http_method; content:"/meteor-client-26.2.jar"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"donutclients.st"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944107/; classtype:trojan-activity;sid:84807207; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944108)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.12.245.227"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944108/; classtype:trojan-activity;sid:84807208; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944109)"; flow:established,from_client; content:"GET"; http_method; content:"/nova-client-26.2.jar"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"donutclients.st"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944109/; classtype:trojan-activity;sid:84807209; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944104)"; flow:established,from_client; content:"GET"; http_method; content:"/freelook-26.2.jar"; http_uri; depth:18; isdataat:!1,relative; nocase; content:"donutclients.st"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944104/; classtype:trojan-activity;sid:84807204; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944105)"; flow:established,from_client; content:"GET"; http_method; content:"/donutextras-26.2.jar"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"donutclients.st"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944105/; classtype:trojan-activity;sid:84807205; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944106)"; flow:established,from_client; content:"GET"; http_method; content:"/mouse_tweaks-26.2.jar"; http_uri; depth:22; isdataat:!1,relative; nocase; content:"donutclients.st"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944106/; classtype:trojan-activity;sid:84807206; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944100)"; flow:established,from_client; content:"GET"; http_method; content:"/appleskin-26.2.jar"; http_uri; depth:19; isdataat:!1,relative; nocase; content:"donutclients.st"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944100/; classtype:trojan-activity;sid:84807200; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944101)"; flow:established,from_client; content:"GET"; http_method; content:"/iris-26.2.jar"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"donutclients.st"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944101/; classtype:trojan-activity;sid:84807201; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944102)"; flow:established,from_client; content:"GET"; http_method; content:"/ferritecore-26.2.jar"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"donutclients.st"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944102/; classtype:trojan-activity;sid:84807202; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944103)"; flow:established,from_client; content:"GET"; http_method; content:"/baritone-26.2.jar"; http_uri; depth:18; isdataat:!1,relative; nocase; content:"donutclients.st"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944103/; classtype:trojan-activity;sid:84807203; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944095)"; flow:established,from_client; content:"GET"; http_method; content:"/nuclearaddons-26.2.jar"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"donutclients.st"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944095/; classtype:trojan-activity;sid:84807195; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944096)"; flow:established,from_client; content:"GET"; http_method; content:"/sodium-26.2.jar"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"donutclients.st"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944096/; classtype:trojan-activity;sid:84807196; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944097)"; flow:established,from_client; content:"GET"; http_method; content:"/zincaddons-26.2.jar"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"donutclients.st"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944097/; classtype:trojan-activity;sid:84807197; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944098)"; flow:established,from_client; content:"GET"; http_method; content:"/litematica-26.2.jar"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"donutclients.st"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944098/; classtype:trojan-activity;sid:84807198; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944099)"; flow:established,from_client; content:"GET"; http_method; content:"/bamboo-client-26.2.jar"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"donutclients.st"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944099/; classtype:trojan-activity;sid:84807199; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944092)"; flow:established,from_client; content:"GET"; http_method; content:"/donut-duper-26.2.jar"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"donutclients.st"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944092/; classtype:trojan-activity;sid:84807192; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944093)"; flow:established,from_client; content:"GET"; http_method; content:"/lithium-26.2.jar"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"donutclients.st"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944093/; classtype:trojan-activity;sid:84807193; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944094)"; flow:established,from_client; content:"GET"; http_method; content:"/donutdupe-1.21.11.jar"; http_uri; depth:22; isdataat:!1,relative; nocase; content:"donutdupe.com"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944094/; classtype:trojan-activity;sid:84807194; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944090)"; flow:established,from_client; content:"GET"; http_method; content:"/api/cm-token"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"docs.cs-supplements.de"; http_host; depth:22; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944090/; classtype:trojan-activity;sid:84807190; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944091)"; flow:established,from_client; content:"GET"; http_method; content:"/gamefiles/image.exe"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"ikovrsps.com"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944091/; classtype:trojan-activity;sid:84807191; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944086)"; flow:established,from_client; content:"GET"; http_method; content:"/zoomify-26.2.jar"; http_uri; depth:17; isdataat:!1,relative; nocase; content:"donutclients.st"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944086/; classtype:trojan-activity;sid:84807186; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944087)"; flow:established,from_client; content:"GET"; http_method; content:"/xaeros_minimap-26.2.jar"; http_uri; depth:24; isdataat:!1,relative; nocase; content:"donutclients.st"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944087/; classtype:trojan-activity;sid:84807187; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944088)"; flow:established,from_client; content:"GET"; http_method; content:"/tiertagger-26.2.jar"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"donutclients.st"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944088/; classtype:trojan-activity;sid:84807188; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944089)"; flow:established,from_client; content:"GET"; http_method; content:"/zav001/534rkyoj34oiy/releases/download/t/donutclient-1.21.11.jar"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944089/; classtype:trojan-activity;sid:84807189; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944080)"; flow:established,from_client; content:"GET"; http_method; content:"/bnana-client-26.2.jar"; http_uri; depth:22; isdataat:!1,relative; nocase; content:"donutclients.st"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944080/; classtype:trojan-activity;sid:84807180; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944081)"; flow:established,from_client; content:"GET"; http_method; content:"/zav001/d3et2t23y3/releases/download/v1/goobaaclient.1.21.11.jar"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944081/; classtype:trojan-activity;sid:84807181; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944082)"; flow:established,from_client; content:"GET"; http_method; content:"/5r3fqt67ew531has4231.arm"; http_uri; depth:25; isdataat:!1,relative; nocase; content:"144.31.150.183"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944082/; classtype:trojan-activity;sid:84807182; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944083)"; flow:established,from_client; content:"GET"; http_method; content:"/worldedit-26.2.jar"; http_uri; depth:19; isdataat:!1,relative; nocase; content:"donutclients.st"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944083/; classtype:trojan-activity;sid:84807183; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944084)"; flow:established,from_client; content:"GET"; http_method; content:"/mina.jar"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"ikovrsps.com"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944084/; classtype:trojan-activity;sid:84807184; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944085)"; flow:established,from_client; content:"GET"; http_method; content:"/exploitpreventer-26.2.jar"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"donutclients.st"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944085/; classtype:trojan-activity;sid:84807185; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944079)"; flow:established,from_client; content:"GET"; http_method; content:"/alex3430/pecky777/blob/main/peckycloner.py"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944079/; classtype:trojan-activity;sid:84807179; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944078)"; flow:established,from_client; content:"GET"; http_method; content:"/view/b757zwtqgif66uar"; http_uri; depth:22; isdataat:!1,relative; nocase; content:"docsend.com"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944078/; classtype:trojan-activity;sid:84807178; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944077)"; flow:established,from_client; content:"GET"; http_method; content:"/alex3430/pecky777/peckycloner.py"; http_uri; depth:33; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944077/; classtype:trojan-activity;sid:84807177; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944076)"; flow:established,from_client; content:"GET"; http_method; content:"/b2f628/cronb.sh"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"b.clu-e.eu"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944076/; classtype:trojan-activity;sid:84807176; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944075)"; flow:established,from_client; content:"GET"; http_method; content:"/attachments/1521843051192909974/1557082337735475301/bundle.zip|3f|ex=6ac6816e|7c|26|7c|is=6ac52fee|7c|26|7c|hm=50797e9782aac04b40538d9ee9d26c6295597c9db1eb374572ffddf733d329bd|7c|26|7c|"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"cdn.discordapp.com"; http_host; depth:18; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944075/; classtype:trojan-activity;sid:84807175; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944074)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.9.200.156"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944074/; classtype:trojan-activity;sid:84807174; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944073)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"117.146.92.46"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944073/; classtype:trojan-activity;sid:84807173; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944072)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.28.194.92"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944072/; classtype:trojan-activity;sid:84807172; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944071)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.15.187.244"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944071/; classtype:trojan-activity;sid:84807171; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944070)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.118.189.126"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944070/; classtype:trojan-activity;sid:84807170; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944067)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"210.97.100.192"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944067/; classtype:trojan-activity;sid:84807167; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944068)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"221.15.187.244"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944068/; classtype:trojan-activity;sid:84807168; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944069)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.14.88.160"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944069/; classtype:trojan-activity;sid:84807169; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944065)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.224.98.161"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944065/; classtype:trojan-activity;sid:84807165; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944066)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"117.146.92.46"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944066/; classtype:trojan-activity;sid:84807166; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944064)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.161.250.191"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944064/; classtype:trojan-activity;sid:84807164; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944061)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.18.37.74"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944061/; classtype:trojan-activity;sid:84807161; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944062)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"61.137.200.25"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944062/; classtype:trojan-activity;sid:84807162; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944063)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"120.28.194.92"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944063/; classtype:trojan-activity;sid:84807163; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944058)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.239.238.224"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944058/; classtype:trojan-activity;sid:84807158; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944059)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.28.192.219"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944059/; classtype:trojan-activity;sid:84807159; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944060)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.18.37.74"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944060/; classtype:trojan-activity;sid:84807160; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944057)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.44.145.183"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944057/; classtype:trojan-activity;sid:84807157; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944056)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.173.2.43"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944056/; classtype:trojan-activity;sid:84807156; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944054)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.127.71.33"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944054/; classtype:trojan-activity;sid:84807154; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944055)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.141.105.180"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944055/; classtype:trojan-activity;sid:84807155; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944053)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"194.26.220.214"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944053/; classtype:trojan-activity;sid:84807153; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944052)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.23.238.68"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944052/; classtype:trojan-activity;sid:84807152; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944050)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.227.46.64"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944050/; classtype:trojan-activity;sid:84807150; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944051)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.224.12.172"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944051/; classtype:trojan-activity;sid:84807151; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944049)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.210.7.195"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944049/; classtype:trojan-activity;sid:84807149; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944048)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"39.77.172.19"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944048/; classtype:trojan-activity;sid:84807148; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944047)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.11.98.224"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944047/; classtype:trojan-activity;sid:84807147; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944046)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.238.246.42"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944046/; classtype:trojan-activity;sid:84807146; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944045)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"176.213.86.238"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944045/; classtype:trojan-activity;sid:84807145; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944044)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.23.235.155"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944044/; classtype:trojan-activity;sid:84807144; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944043)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.130.203.216"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944043/; classtype:trojan-activity;sid:84807143; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944041)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.23.239.66"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944041/; classtype:trojan-activity;sid:84807141; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944042)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"117.253.155.54"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944042/; classtype:trojan-activity;sid:84807142; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944039)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"91.190.84.93"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944039/; classtype:trojan-activity;sid:84807139; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944040)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.23.238.68"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944040/; classtype:trojan-activity;sid:84807140; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944038)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"103.68.95.197"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944038/; classtype:trojan-activity;sid:84807138; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944037)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.234.233.75"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944037/; classtype:trojan-activity;sid:84807137; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944036)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.44.145.183"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944036/; classtype:trojan-activity;sid:84807136; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944032)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"91.190.84.93"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944032/; classtype:trojan-activity;sid:84807132; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944033)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.126.177.210"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944033/; classtype:trojan-activity;sid:84807133; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944034)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.55.223.110"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944034/; classtype:trojan-activity;sid:84807134; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944035)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"39.79.138.192"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944035/; classtype:trojan-activity;sid:84807135; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944031)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"170.84.133.234"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944031/; classtype:trojan-activity;sid:84807131; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944030)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"165.98.243.83"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944030/; classtype:trojan-activity;sid:84807130; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944028)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.50.235.154"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944028/; classtype:trojan-activity;sid:84807128; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944029)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.148.143.61"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944029/; classtype:trojan-activity;sid:84807129; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944027)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.28.200.110"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944027/; classtype:trojan-activity;sid:84807127; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944026)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"221.15.185.65"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944026/; classtype:trojan-activity;sid:84807126; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944025)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.121.47.144"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944025/; classtype:trojan-activity;sid:84807125; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944024)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"210.208.111.26"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944024/; classtype:trojan-activity;sid:84807124; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944023)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.10.70.76"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944023/; classtype:trojan-activity;sid:84807123; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944019)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.217.57.46"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944019/; classtype:trojan-activity;sid:84807119; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944020)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.50.221.110"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944020/; classtype:trojan-activity;sid:84807120; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944021)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.14.55.235"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944021/; classtype:trojan-activity;sid:84807121; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944022)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.210.7.195"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944022/; classtype:trojan-activity;sid:84807122; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944018)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"210.208.111.26"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944018/; classtype:trojan-activity;sid:84807118; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944017)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.142.247.47"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944017/; classtype:trojan-activity;sid:84807117; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944016)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"78.187.230.204"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944016/; classtype:trojan-activity;sid:84807116; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944014)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.161.1.232"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944014/; classtype:trojan-activity;sid:84807114; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944015)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.96.139.237"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944015/; classtype:trojan-activity;sid:84807115; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944012)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"108.170.136.155"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944012/; classtype:trojan-activity;sid:84807112; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944013)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.121.47.144"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944013/; classtype:trojan-activity;sid:84807113; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944011)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.189.198.173"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944011/; classtype:trojan-activity;sid:84807111; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944010)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.147.200.123"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944010/; classtype:trojan-activity;sid:84807110; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944006)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.217.57.46"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944006/; classtype:trojan-activity;sid:84807106; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944007)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.147.94.199"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944007/; classtype:trojan-activity;sid:84807107; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944008)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.14.55.235"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944008/; classtype:trojan-activity;sid:84807108; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944009)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.106.111.244"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944009/; classtype:trojan-activity;sid:84807109; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944004)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.114.34.109"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944004/; classtype:trojan-activity;sid:84807104; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944005)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"164.163.26.124"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944005/; classtype:trojan-activity;sid:84807105; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944003)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.142.247.47"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944003/; classtype:trojan-activity;sid:84807103; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944001)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"196.189.198.173"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944001/; classtype:trojan-activity;sid:84807101; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944002)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.126.126.199"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944002/; classtype:trojan-activity;sid:84807102; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3944000)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.148.159.44"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3944000/; classtype:trojan-activity;sid:84807100; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943998)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.13.85.107"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3943998/; classtype:trojan-activity;sid:84807098; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943999)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.184.177.149"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3943999/; classtype:trojan-activity;sid:84807099; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943997)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.239.254.29"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3943997/; classtype:trojan-activity;sid:84807097; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943996)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"179.49.213.85"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3943996/; classtype:trojan-activity;sid:84807096; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943994)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"210.57.226.6"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3943994/; classtype:trojan-activity;sid:84807094; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943995)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.239.254.29"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3943995/; classtype:trojan-activity;sid:84807095; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943993)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"45.148.148.31"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3943993/; classtype:trojan-activity;sid:84807093; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943992)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.16.135.182"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3943992/; classtype:trojan-activity;sid:84807092; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943987)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.129.56.38"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3943987/; classtype:trojan-activity;sid:84807087; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943988)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.141.122.53"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3943988/; classtype:trojan-activity;sid:84807088; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943989)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"113.231.230.20"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3943989/; classtype:trojan-activity;sid:84807089; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943990)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"114.239.56.148"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3943990/; classtype:trojan-activity;sid:84807090; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943991)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"178.34.124.22"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3943991/; classtype:trojan-activity;sid:84807091; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943985)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.5.169.0"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3943985/; classtype:trojan-activity;sid:84807085; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943986)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"179.49.213.85"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_07; reference:url, urlhaus.abuse.ch/url/3943986/; classtype:trojan-activity;sid:84807086; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943984)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.59.88.197"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943984/; classtype:trojan-activity;sid:84807084; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943982)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.232.235.138"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943982/; classtype:trojan-activity;sid:84807082; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943983)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"187.62.243.142"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943983/; classtype:trojan-activity;sid:84807083; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943979)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"78.188.196.206"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943979/; classtype:trojan-activity;sid:84807079; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943980)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"78.188.196.206"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943980/; classtype:trojan-activity;sid:84807080; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943981)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.5.169.0"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943981/; classtype:trojan-activity;sid:84807081; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943978)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"112.225.105.182"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943978/; classtype:trojan-activity;sid:84807078; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943977)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.234.163.19"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943977/; classtype:trojan-activity;sid:84807077; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943976)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"185.89.156.101"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943976/; classtype:trojan-activity;sid:84807076; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943974)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.51.88.191"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943974/; classtype:trojan-activity;sid:84807074; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943975)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.129.56.38"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943975/; classtype:trojan-activity;sid:84807075; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943971)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"92.42.134.80"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943971/; classtype:trojan-activity;sid:84807071; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943972)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.225.13.115"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943972/; classtype:trojan-activity;sid:84807072; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943973)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.96.139.69"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943973/; classtype:trojan-activity;sid:84807073; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943969)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.179.30.73"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943969/; classtype:trojan-activity;sid:84807069; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943970)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.51.139.132"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943970/; classtype:trojan-activity;sid:84807070; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943968)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.234.163.19"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943968/; classtype:trojan-activity;sid:84807068; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943967)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.127.170.183"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943967/; classtype:trojan-activity;sid:84807067; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943965)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"117.131.92.150"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943965/; classtype:trojan-activity;sid:84807065; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943966)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.28.167.203"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943966/; classtype:trojan-activity;sid:84807066; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943964)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.121.16.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943964/; classtype:trojan-activity;sid:84807064; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943963)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"103.111.23.13"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943963/; classtype:trojan-activity;sid:84807063; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943961)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.179.254.148"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943961/; classtype:trojan-activity;sid:84807061; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943962)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"120.28.167.203"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943962/; classtype:trojan-activity;sid:84807062; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943960)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"196.189.35.226"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943960/; classtype:trojan-activity;sid:84807060; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943959)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"117.131.92.150"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943959/; classtype:trojan-activity;sid:84807059; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943958)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"117.253.155.54"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943958/; classtype:trojan-activity;sid:84807058; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943957)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"119.179.254.148"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943957/; classtype:trojan-activity;sid:84807057; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943956)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.189.35.172"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943956/; classtype:trojan-activity;sid:84807056; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943955)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.229.80.225"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943955/; classtype:trojan-activity;sid:84807055; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943954)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.191.233.24"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943954/; classtype:trojan-activity;sid:84807054; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943952)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.127.170.183"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943952/; classtype:trojan-activity;sid:84807052; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943953)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.189.35.226"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943953/; classtype:trojan-activity;sid:84807053; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943951)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"112.248.29.124"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943951/; classtype:trojan-activity;sid:84807051; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943950)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.136.231.249"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943950/; classtype:trojan-activity;sid:84807050; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943949)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"113.229.80.225"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943949/; classtype:trojan-activity;sid:84807049; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943948)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.224.102.171"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943948/; classtype:trojan-activity;sid:84807048; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943947)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.177.57.76"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943947/; classtype:trojan-activity;sid:84807047; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943946)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.41.77.54"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943946/; classtype:trojan-activity;sid:84807046; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943945)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.126.126.199"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943945/; classtype:trojan-activity;sid:84807045; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943941)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.176.8.34"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943941/; classtype:trojan-activity;sid:84807041; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943942)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.54.110.21"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943942/; classtype:trojan-activity;sid:84807042; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943943)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.28.215.36"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943943/; classtype:trojan-activity;sid:84807043; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943944)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.50.216.143"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943944/; classtype:trojan-activity;sid:84807044; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943940)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.137.97.203"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943940/; classtype:trojan-activity;sid:84807040; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943939)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"124.94.246.227"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943939/; classtype:trojan-activity;sid:84807039; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943938)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.120.3.227"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943938/; classtype:trojan-activity;sid:84807038; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943937)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"200.115.102.16"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943937/; classtype:trojan-activity;sid:84807037; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943936)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"124.94.246.227"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943936/; classtype:trojan-activity;sid:84807036; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943935)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.137.97.203"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943935/; classtype:trojan-activity;sid:84807035; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943934)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.54.108.137"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943934/; classtype:trojan-activity;sid:84807034; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943931)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"39.90.144.60"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943931/; classtype:trojan-activity;sid:84807031; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943932)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"113.231.232.203"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943932/; classtype:trojan-activity;sid:84807032; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943933)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"200.115.102.16"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943933/; classtype:trojan-activity;sid:84807033; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943930)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"45.183.184.74"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943930/; classtype:trojan-activity;sid:84807030; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943929)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"39.90.144.60"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943929/; classtype:trojan-activity;sid:84807029; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943927)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.28.194.160"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943927/; classtype:trojan-activity;sid:84807027; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943928)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.23.238.248"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943928/; classtype:trojan-activity;sid:84807028; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943926)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.237.110.126"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943926/; classtype:trojan-activity;sid:84807026; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943925)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.121.16.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943925/; classtype:trojan-activity;sid:84807025; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943922)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.13.0.143"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943922/; classtype:trojan-activity;sid:84807022; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943923)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.231.232.203"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943923/; classtype:trojan-activity;sid:84807023; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943924)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.141.122.53"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943924/; classtype:trojan-activity;sid:84807024; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943921)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.180.162.153"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943921/; classtype:trojan-activity;sid:84807021; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943920)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.55.223.110"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943920/; classtype:trojan-activity;sid:84807020; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943917)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.113.200.36"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943917/; classtype:trojan-activity;sid:84807017; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943918)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.215.181.136"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943918/; classtype:trojan-activity;sid:84807018; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943919)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.54.233.226"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943919/; classtype:trojan-activity;sid:84807019; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943916)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.121.139.213"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943916/; classtype:trojan-activity;sid:84807016; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943915)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"124.6.167.121"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943915/; classtype:trojan-activity;sid:84807015; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943914)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.224.151.147"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943914/; classtype:trojan-activity;sid:84807014; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943913)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"221.200.211.78"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943913/; classtype:trojan-activity;sid:84807013; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943912)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.191.231.12"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943912/; classtype:trojan-activity;sid:84807012; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943910)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.224.151.147"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943910/; classtype:trojan-activity;sid:84807010; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943911)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"116.149.147.99"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943911/; classtype:trojan-activity;sid:84807011; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943909)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.237.229.123"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943909/; classtype:trojan-activity;sid:84807009; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943908)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.7.222.8"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943908/; classtype:trojan-activity;sid:84807008; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943907)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.215.182.212"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943907/; classtype:trojan-activity;sid:84807007; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943906)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"83.228.109.209"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943906/; classtype:trojan-activity;sid:84807006; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943900)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.96.142.159"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943900/; classtype:trojan-activity;sid:84807000; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943901)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"116.138.107.166"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943901/; classtype:trojan-activity;sid:84807001; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943902)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.230.131.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943902/; classtype:trojan-activity;sid:84807002; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943903)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.230.131.69"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943903/; classtype:trojan-activity;sid:84807003; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943904)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"116.138.191.211"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943904/; classtype:trojan-activity;sid:84807004; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943905)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.51.98.26"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943905/; classtype:trojan-activity;sid:84807005; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943899)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.137.150.107"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943899/; classtype:trojan-activity;sid:84806999; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943898)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.45.17.175"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943898/; classtype:trojan-activity;sid:84806998; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943897)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"116.138.107.166"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943897/; classtype:trojan-activity;sid:84806997; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943895)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.112.31.192"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943895/; classtype:trojan-activity;sid:84806995; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943896)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"66.58.168.70"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943896/; classtype:trojan-activity;sid:84806996; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943893)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.225.6.143"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943893/; classtype:trojan-activity;sid:84806993; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943894)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.96.229.130"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943894/; classtype:trojan-activity;sid:84806994; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943890)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.48.142.169"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943890/; classtype:trojan-activity;sid:84806990; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943891)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.246.12.105"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943891/; classtype:trojan-activity;sid:84806991; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943892)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"61.137.150.107"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943892/; classtype:trojan-activity;sid:84806992; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943889)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.246.12.105"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943889/; classtype:trojan-activity;sid:84806989; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943886)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.222.45.79"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943886/; classtype:trojan-activity;sid:84806986; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943887)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.141.21.208"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943887/; classtype:trojan-activity;sid:84806987; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943888)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.37.226.182"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943888/; classtype:trojan-activity;sid:84806988; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943885)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"84.51.204.125"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943885/; classtype:trojan-activity;sid:84806985; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943884)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.140.196.83"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943884/; classtype:trojan-activity;sid:84806984; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943883)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.127.50.102"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943883/; classtype:trojan-activity;sid:84806983; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943882)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.221.72.254"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943882/; classtype:trojan-activity;sid:84806982; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943881)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.127.50.102"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943881/; classtype:trojan-activity;sid:84806981; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943877)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.222.45.79"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943877/; classtype:trojan-activity;sid:84806977; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943878)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.147.89.176"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943878/; classtype:trojan-activity;sid:84806978; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943879)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.63.12.140"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943879/; classtype:trojan-activity;sid:84806979; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943880)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.141.21.208"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943880/; classtype:trojan-activity;sid:84806980; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943876)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.184.240.215"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943876/; classtype:trojan-activity;sid:84806976; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943875)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.148.143.61"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943875/; classtype:trojan-activity;sid:84806975; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943874)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"113.221.72.254"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943874/; classtype:trojan-activity;sid:84806974; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943873)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"210.208.110.4"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943873/; classtype:trojan-activity;sid:84806973; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943871)"; flow:established,from_client; content:"GET"; http_method; content:"/niehgns/yo3/raw/refs/heads/main/fakepayclient-1.21.11.jar"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943871/; classtype:trojan-activity;sid:84806971; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943872)"; flow:established,from_client; content:"GET"; http_method; content:"/niehgns/yo3/raw/refs/heads/main/kryptonclient-1.21.11.jar"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943872/; classtype:trojan-activity;sid:84806972; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943866)"; flow:established,from_client; content:"GET"; http_method; content:"/ikov.jar"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"ikovrsps.com"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943866/; classtype:trojan-activity;sid:84806966; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943867)"; flow:established,from_client; content:"GET"; http_method; content:"/niehgns/yo3/raw/refs/heads/main/xenonclient-1.21.11.jar"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943867/; classtype:trojan-activity;sid:84806967; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943868)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.119.176.144"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943868/; classtype:trojan-activity;sid:84806968; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943869)"; flow:established,from_client; content:"GET"; http_method; content:"/niehgns/yo3/raw/refs/heads/main/radiumclient-clients-full.jar"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943869/; classtype:trojan-activity;sid:84806969; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943870)"; flow:established,from_client; content:"GET"; http_method; content:"/niehgns/yo3/raw/refs/heads/main/dqrkisclient-1.21.11.jar"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943870/; classtype:trojan-activity;sid:84806970; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943865)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.246.43.55"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943865/; classtype:trojan-activity;sid:84806965; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943864)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.m"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"221.3.87.188"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943864/; classtype:trojan-activity;sid:84806964; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943863)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"130.12.209.132"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943863/; classtype:trojan-activity;sid:84806963; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943862)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"114.227.63.106"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943862/; classtype:trojan-activity;sid:84806962; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943861)"; flow:established,from_client; content:"GET"; http_method; content:"/flutter.arm6"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"94.154.43.34"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943861/; classtype:trojan-activity;sid:84806961; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943849)"; flow:established,from_client; content:"GET"; http_method; content:"/flutter.mips"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"94.154.43.34"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943849/; classtype:trojan-activity;sid:84806949; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943850)"; flow:established,from_client; content:"GET"; http_method; content:"/flutter.m68k"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"94.154.43.34"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943850/; classtype:trojan-activity;sid:84806950; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943851)"; flow:established,from_client; content:"GET"; http_method; content:"/flutter.x86"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"94.154.43.34"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943851/; classtype:trojan-activity;sid:84806951; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943852)"; flow:established,from_client; content:"GET"; http_method; content:"/flutter.arm7"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"94.154.43.34"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943852/; classtype:trojan-activity;sid:84806952; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943853)"; flow:established,from_client; content:"GET"; http_method; content:"/flutter.arm5"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"94.154.43.34"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943853/; classtype:trojan-activity;sid:84806953; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943854)"; flow:established,from_client; content:"GET"; http_method; content:"/flutter.arm8"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"94.154.43.34"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943854/; classtype:trojan-activity;sid:84806954; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943855)"; flow:established,from_client; content:"GET"; http_method; content:"/flutter.x86_64"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"94.154.43.34"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943855/; classtype:trojan-activity;sid:84806955; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943856)"; flow:established,from_client; content:"GET"; http_method; content:"/flutter.ppc"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"94.154.43.34"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943856/; classtype:trojan-activity;sid:84806956; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943857)"; flow:established,from_client; content:"GET"; http_method; content:"/flutter.ppc64"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"94.154.43.34"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943857/; classtype:trojan-activity;sid:84806957; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943858)"; flow:established,from_client; content:"GET"; http_method; content:"/flutter.arm"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"94.154.43.34"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943858/; classtype:trojan-activity;sid:84806958; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943859)"; flow:established,from_client; content:"GET"; http_method; content:"/flutter.mipsel"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"94.154.43.34"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943859/; classtype:trojan-activity;sid:84806959; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943860)"; flow:established,from_client; content:"GET"; http_method; content:"/flutter.debug"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"94.154.43.34"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943860/; classtype:trojan-activity;sid:84806960; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943848)"; flow:established,from_client; content:"GET"; http_method; content:"/dl.sh"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"94.154.43.34"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943848/; classtype:trojan-activity;sid:84806948; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943847)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/mpsl"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"176.65.139.35"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943847/; classtype:trojan-activity;sid:84806947; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943846)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/spc"; http_uri; depth:14; isdataat:!1,relative; nocase; content:"176.65.139.35"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943846/; classtype:trojan-activity;sid:84806946; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943841)"; flow:established,from_client; content:"GET"; http_method; content:"/mips64"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"176.65.139.155"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943841/; classtype:trojan-activity;sid:84806941; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943842)"; flow:established,from_client; content:"GET"; http_method; content:"/ppc64"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"176.65.139.155"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943842/; classtype:trojan-activity;sid:84806942; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943843)"; flow:established,from_client; content:"GET"; http_method; content:"/mipsel"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"176.65.139.155"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943843/; classtype:trojan-activity;sid:84806943; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943844)"; flow:established,from_client; content:"GET"; http_method; content:"/i686"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"176.65.139.155"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943844/; classtype:trojan-activity;sid:84806944; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943845)"; flow:established,from_client; content:"GET"; http_method; content:"/mips"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"176.65.139.155"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943845/; classtype:trojan-activity;sid:84806945; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943834)"; flow:established,from_client; content:"GET"; http_method; content:"/amd64"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"176.65.139.155"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943834/; classtype:trojan-activity;sid:84806934; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943835)"; flow:established,from_client; content:"GET"; http_method; content:"/arm64"; http_uri; depth:6; isdataat:!1,relative; nocase; content:"176.65.139.155"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943835/; classtype:trojan-activity;sid:84806935; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943836)"; flow:established,from_client; content:"GET"; http_method; content:"/armv7l"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"176.65.139.155"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943836/; classtype:trojan-activity;sid:84806936; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943837)"; flow:established,from_client; content:"GET"; http_method; content:"/armv6l"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"176.65.139.155"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943837/; classtype:trojan-activity;sid:84806937; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943838)"; flow:established,from_client; content:"GET"; http_method; content:"/mips64le"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"176.65.139.155"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943838/; classtype:trojan-activity;sid:84806938; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943839)"; flow:established,from_client; content:"GET"; http_method; content:"/armv5l"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"176.65.139.155"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943839/; classtype:trojan-activity;sid:84806939; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943840)"; flow:established,from_client; content:"GET"; http_method; content:"/ppc64le"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"176.65.139.155"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943840/; classtype:trojan-activity;sid:84806940; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943833)"; flow:established,from_client; content:"GET"; http_method; content:"/bot.x86"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"77.90.57.20"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943833/; classtype:trojan-activity;sid:84806933; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943832)"; flow:established,from_client; content:"GET"; http_method; content:"/run.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"176.65.139.155"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943832/; classtype:trojan-activity;sid:84806932; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943831)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.62.117.185"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943831/; classtype:trojan-activity;sid:84806931; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943830)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"80.67.33.209"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943830/; classtype:trojan-activity;sid:84806930; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943828)"; flow:established,from_client; content:"GET"; http_method; content:"/bot.mips"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"77.90.57.20"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943828/; classtype:trojan-activity;sid:84806928; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943829)"; flow:established,from_client; content:"GET"; http_method; content:"/bot_arm"; http_uri; depth:8; isdataat:!1,relative; nocase; content:"77.90.57.20"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943829/; classtype:trojan-activity;sid:84806929; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943827)"; flow:established,from_client; content:"GET"; http_method; content:"/iran.armv5l"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"176.65.139.204"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943827/; classtype:trojan-activity;sid:84806927; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943823)"; flow:established,from_client; content:"GET"; http_method; content:"/iran.mipsel"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"176.65.139.204"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943823/; classtype:trojan-activity;sid:84806923; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943824)"; flow:established,from_client; content:"GET"; http_method; content:"/iran.armv6l"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"176.65.139.204"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943824/; classtype:trojan-activity;sid:84806924; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943825)"; flow:established,from_client; content:"GET"; http_method; content:"/iran.m68k"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"176.65.139.204"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943825/; classtype:trojan-activity;sid:84806925; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943826)"; flow:established,from_client; content:"GET"; http_method; content:"/iran.sh4"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"176.65.139.204"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943826/; classtype:trojan-activity;sid:84806926; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943816)"; flow:established,from_client; content:"GET"; http_method; content:"/iran.powerpc"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"176.65.139.204"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943816/; classtype:trojan-activity;sid:84806916; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943817)"; flow:established,from_client; content:"GET"; http_method; content:"/mips"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"176.65.139.204"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943817/; classtype:trojan-activity;sid:84806917; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943818)"; flow:established,from_client; content:"GET"; http_method; content:"/iran.x86_64"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"176.65.139.204"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943818/; classtype:trojan-activity;sid:84806918; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943819)"; flow:established,from_client; content:"GET"; http_method; content:"/mipsel"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"176.65.139.204"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943819/; classtype:trojan-activity;sid:84806919; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943820)"; flow:established,from_client; content:"GET"; http_method; content:"/iran.sparc"; http_uri; depth:11; isdataat:!1,relative; nocase; content:"176.65.139.204"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943820/; classtype:trojan-activity;sid:84806920; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943821)"; flow:established,from_client; content:"GET"; http_method; content:"/iran.armv4l"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"176.65.139.204"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943821/; classtype:trojan-activity;sid:84806921; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943822)"; flow:established,from_client; content:"GET"; http_method; content:"/iran.mipsrouter"; http_uri; depth:16; isdataat:!1,relative; nocase; content:"176.65.139.204"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943822/; classtype:trojan-activity;sid:84806922; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943813)"; flow:established,from_client; content:"GET"; http_method; content:"/iran.armv7l"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"176.65.139.204"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943813/; classtype:trojan-activity;sid:84806913; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943814)"; flow:established,from_client; content:"GET"; http_method; content:"/iran.aarch64"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"176.65.139.204"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943814/; classtype:trojan-activity;sid:84806914; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943815)"; flow:established,from_client; content:"GET"; http_method; content:"/iran.mips"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"176.65.139.204"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943815/; classtype:trojan-activity;sid:84806915; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943811)"; flow:established,from_client; content:"GET"; http_method; content:"/iran.arc"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"176.65.139.204"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943811/; classtype:trojan-activity;sid:84806911; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943812)"; flow:established,from_client; content:"GET"; http_method; content:"/cat.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"176.65.139.204"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943812/; classtype:trojan-activity;sid:84806912; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943808)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/mipsel"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"176.65.139.204"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943808/; classtype:trojan-activity;sid:84806908; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943809)"; flow:established,from_client; content:"GET"; http_method; content:"/telnet.sh"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"176.65.139.204"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943809/; classtype:trojan-activity;sid:84806909; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943810)"; flow:established,from_client; content:"GET"; http_method; content:"/iran.i486"; http_uri; depth:10; isdataat:!1,relative; nocase; content:"176.65.139.204"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943810/; classtype:trojan-activity;sid:84806910; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943807)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"79.106.231.174"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943807/; classtype:trojan-activity;sid:84806907; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943806)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.246.43.55"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943806/; classtype:trojan-activity;sid:84806906; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943805)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.141.105.180"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943805/; classtype:trojan-activity;sid:84806905; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943801)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.49.4.214"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943801/; classtype:trojan-activity;sid:84806901; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943802)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.52.20.128"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943802/; classtype:trojan-activity;sid:84806902; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943803)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"180.115.161.198"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943803/; classtype:trojan-activity;sid:84806903; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943804)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"203.177.251.31"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943804/; classtype:trojan-activity;sid:84806904; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943800)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"188.187.91.186"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943800/; classtype:trojan-activity;sid:84806900; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943798)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"221.194.101.213"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943798/; classtype:trojan-activity;sid:84806898; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943799)"; flow:established,from_client; content:"GET"; http_method; content:"/bot.arm7"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"77.90.57.20"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943799/; classtype:trojan-activity;sid:84806899; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943793)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.mpsl"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"139.162.5.254"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943793/; classtype:trojan-activity;sid:84806893; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943794)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.sparc"; http_uri; depth:22; isdataat:!1,relative; nocase; content:"139.162.5.254"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943794/; classtype:trojan-activity;sid:84806894; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943795)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.mips"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"139.162.5.254"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943795/; classtype:trojan-activity;sid:84806895; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943796)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arm"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"139.162.5.254"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943796/; classtype:trojan-activity;sid:84806896; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943797)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.ppc"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"139.162.5.254"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943797/; classtype:trojan-activity;sid:84806897; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943792)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.sh4"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"139.162.5.254"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943792/; classtype:trojan-activity;sid:84806892; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943787)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arm6"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"139.162.5.254"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943787/; classtype:trojan-activity;sid:84806887; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943788)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arm5"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"139.162.5.254"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943788/; classtype:trojan-activity;sid:84806888; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943789)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.m68k"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"139.162.5.254"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943789/; classtype:trojan-activity;sid:84806889; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943790)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.mips64"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"139.162.5.254"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943790/; classtype:trojan-activity;sid:84806890; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943791)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arm7"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"139.162.5.254"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943791/; classtype:trojan-activity;sid:84806891; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943786)"; flow:established,from_client; content:"GET"; http_method; content:"/bot.mpsl"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"77.90.57.20"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943786/; classtype:trojan-activity;sid:84806886; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943785)"; flow:established,from_client; content:"GET"; http_method; content:"/download|3f|id=1zntk1iihb4tc_tnggamwtys_obebz9xv|7c|26|7c|export=download"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"drive.usercontent.google.com"; http_host; depth:28; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943785/; classtype:trojan-activity;sid:84806885; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943784)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"157.66.146.183"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943784/; classtype:trojan-activity;sid:84806884; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943783)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.126.177.210"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943783/; classtype:trojan-activity;sid:84806883; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943782)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.49.4.214"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943782/; classtype:trojan-activity;sid:84806882; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943781)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.140.190.133"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943781/; classtype:trojan-activity;sid:84806881; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943780)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"120.28.195.142"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943780/; classtype:trojan-activity;sid:84806880; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943779)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"59.180.190.45"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943779/; classtype:trojan-activity;sid:84806879; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943777)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"42.224.98.161"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943777/; classtype:trojan-activity;sid:84806877; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943778)"; flow:established,from_client; content:"GET"; http_method; content:"/bot"; http_uri; depth:4; isdataat:!1,relative; nocase; content:"77.90.57.20"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943778/; classtype:trojan-activity;sid:84806878; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943776)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"39.74.47.172"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943776/; classtype:trojan-activity;sid:84806876; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943775)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.9.197.209"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943775/; classtype:trojan-activity;sid:84806875; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943774)"; flow:established,from_client; content:"GET"; http_method; content:"/scl/fi/i4frru67ve46dbh42gxke/docsend.exe|3f|rlkey=385ywqxitj0l3g5yhfsecvoke|7c|26|7c|st=8a337sm5|7c|26|7c|dl=1"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"www.dropbox.com"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943774/; classtype:trojan-activity;sid:84806874; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943773)"; flow:established,from_client; content:"GET"; http_method; content:"/hibituninstaller-setup-4.0.10.zip"; http_uri; depth:34; isdataat:!1,relative; nocase; content:"pub-6a90252f6d70443d960d6ac029dbd446.r2.dev"; http_host; depth:43; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943773/; classtype:trojan-activity;sid:84806873; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943772)"; flow:established,from_client; content:"GET"; http_method; content:"/miners/srbminer-3.5.6.zip"; http_uri; depth:26; isdataat:!1,relative; nocase; content:"pub-ecb7161ffc7a4a67bdd8761583e21d16.r2.dev"; http_host; depth:43; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943772/; classtype:trojan-activity;sid:84806872; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943770)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.23.233.119"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943770/; classtype:trojan-activity;sid:84806870; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943771)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"114.227.63.106"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943771/; classtype:trojan-activity;sid:84806871; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943769)"; flow:established,from_client; content:"GET"; http_method; content:"/s/n1w4p8gc6jzo0sg/supdate.ini"; http_uri; depth:30; isdataat:!1,relative; nocase; content:"www.dropbox.com"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943769/; classtype:trojan-activity;sid:84806869; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943766)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.165.82.252"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943766/; classtype:trojan-activity;sid:84806866; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943767)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.24.87.31"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943767/; classtype:trojan-activity;sid:84806867; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943768)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.44.145.25"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943768/; classtype:trojan-activity;sid:84806868; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943765)"; flow:established,from_client; content:"GET"; http_method; content:"/s/zhp1b06imehwylq/synaptics.rar"; http_uri; depth:32; isdataat:!1,relative; nocase; content:"www.dropbox.com"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943765/; classtype:trojan-activity;sid:84806865; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943764)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"124.6.167.113"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943764/; classtype:trojan-activity;sid:84806864; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943763)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.9.197.209"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943763/; classtype:trojan-activity;sid:84806863; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943762)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"120.84.213.140"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943762/; classtype:trojan-activity;sid:84806862; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943761)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.24.87.31"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943761/; classtype:trojan-activity;sid:84806861; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943760)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"120.28.189.218"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943760/; classtype:trojan-activity;sid:84806860; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943759)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.23.238.248"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943759/; classtype:trojan-activity;sid:84806859; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943758)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.165.82.252"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943758/; classtype:trojan-activity;sid:84806858; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943757)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"124.6.167.113"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943757/; classtype:trojan-activity;sid:84806857; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943756)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.44.145.25"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943756/; classtype:trojan-activity;sid:84806856; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943755)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.56.157.241"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943755/; classtype:trojan-activity;sid:84806855; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943754)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.127.77.227"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943754/; classtype:trojan-activity;sid:84806854; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943753)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.117.76.203"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943753/; classtype:trojan-activity;sid:84806853; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943751)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.142.253.202"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943751/; classtype:trojan-activity;sid:84806851; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943752)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.i686"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"139.162.5.254"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943752/; classtype:trojan-activity;sid:84806852; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943750)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"112.248.144.46"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943750/; classtype:trojan-activity;sid:84806850; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943749)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.13.0.143"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943749/; classtype:trojan-activity;sid:84806849; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943748)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"112.248.29.124"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943748/; classtype:trojan-activity;sid:84806848; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943747)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"119.117.76.203"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943747/; classtype:trojan-activity;sid:84806847; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943743)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"190.109.227.236"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943743/; classtype:trojan-activity;sid:84806843; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943744)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.x86_64"; http_uri; depth:23; isdataat:!1,relative; nocase; content:"139.162.5.254"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943744/; classtype:trojan-activity;sid:84806844; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943745)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.x86"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"139.162.5.254"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943745/; classtype:trojan-activity;sid:84806845; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943746)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"36.88.136.194"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943746/; classtype:trojan-activity;sid:84806846; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943742)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"185.130.235.107"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943742/; classtype:trojan-activity;sid:84806842; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943741)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.44.146.156"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943741/; classtype:trojan-activity;sid:84806841; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943739)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.225.76.225"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943739/; classtype:trojan-activity;sid:84806839; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943740)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.238.99.253"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943740/; classtype:trojan-activity;sid:84806840; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943737)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"175.147.38.110"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943737/; classtype:trojan-activity;sid:84806837; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943738)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"145.236.202.102"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943738/; classtype:trojan-activity;sid:84806838; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943736)"; flow:established,from_client; content:"GET"; http_method; content:"/lnvoice/screenconnect.clientsetup.msi"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"omskin.org"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943736/; classtype:trojan-activity;sid:84806836; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943734)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"113.231.230.20"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943734/; classtype:trojan-activity;sid:84806834; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943735)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.147.38.110"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943735/; classtype:trojan-activity;sid:84806835; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943731)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"196.190.195.130"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943731/; classtype:trojan-activity;sid:84806831; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943732)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.117.40.200"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943732/; classtype:trojan-activity;sid:84806832; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943733)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"196.190.195.130"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943733/; classtype:trojan-activity;sid:84806833; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943730)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"188.187.91.186"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943730/; classtype:trojan-activity;sid:84806830; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943729)"; flow:established,from_client; content:"GET"; http_method; content:"/scl/fi/5f11m34f13trts6jj7rhi/matefall-nstaller-setup-1.0.0.exe|3f|rlkey=fzctb8qe415ql6i8njxhy55c0|7c|26|7c|st=6u4vagho|7c|26|7c|dl=1"; http_uri; depth:133; isdataat:!1,relative; nocase; content:"www.dropbox.com"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943729/; classtype:trojan-activity;sid:84806829; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943728)"; flow:established,from_client; content:"GET"; http_method; content:"/download.php"; http_uri; depth:13; isdataat:!1,relative; nocase; content:"alotic.net"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943728/; classtype:trojan-activity;sid:84806828; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943726)"; flow:established,from_client; content:"GET"; http_method; content:"/hiddenbin/space.arc"; http_uri; depth:20; isdataat:!1,relative; nocase; content:"139.162.5.254"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943726/; classtype:trojan-activity;sid:84806826; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943727)"; flow:established,from_client; content:"GET"; http_method; content:"/1.sh"; http_uri; depth:5; isdataat:!1,relative; nocase; content:"139.162.5.254"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943727/; classtype:trojan-activity;sid:84806827; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943725)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.139.36.192"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943725/; classtype:trojan-activity;sid:84806825; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943724)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.237.110.126"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943724/; classtype:trojan-activity;sid:84806824; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943723)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.56.151.141"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943723/; classtype:trojan-activity;sid:84806823; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943722)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.172.82.253"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943722/; classtype:trojan-activity;sid:84806822; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943721)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"175.165.86.254"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943721/; classtype:trojan-activity;sid:84806821; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943719)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"210.208.110.4"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943719/; classtype:trojan-activity;sid:84806819; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943720)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.220.121.135"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943720/; classtype:trojan-activity;sid:84806820; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943718)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"111.88.7.48"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943718/; classtype:trojan-activity;sid:84806818; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943717)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.53.100.94"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943717/; classtype:trojan-activity;sid:84806817; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943715)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.139.36.192"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943715/; classtype:trojan-activity;sid:84806815; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943716)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"221.1.110.140"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943716/; classtype:trojan-activity;sid:84806816; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943713)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"119.116.34.38"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943713/; classtype:trojan-activity;sid:84806813; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943714)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.61.118.217"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943714/; classtype:trojan-activity;sid:84806814; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943711)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.61.118.217"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943711/; classtype:trojan-activity;sid:84806811; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943712)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"61.52.47.76"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943712/; classtype:trojan-activity;sid:84806812; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943710)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"41.216.227.142"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943710/; classtype:trojan-activity;sid:84806810; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943709)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"119.116.34.38"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943709/; classtype:trojan-activity;sid:84806809; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943707)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"106.40.243.83"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943707/; classtype:trojan-activity;sid:84806807; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943708)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.28.97.96"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943708/; classtype:trojan-activity;sid:84806808; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943706)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.156.51.237"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943706/; classtype:trojan-activity;sid:84806806; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943705)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"61.52.47.76"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943705/; classtype:trojan-activity;sid:84806805; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943703)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.49.211.221"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943703/; classtype:trojan-activity;sid:84806803; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943704)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.155.228.240"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943704/; classtype:trojan-activity;sid:84806804; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943702)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"120.82.203.7"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943702/; classtype:trojan-activity;sid:84806802; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943701)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"222.127.243.18"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943701/; classtype:trojan-activity;sid:84806801; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943699)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.50.221.110"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943699/; classtype:trojan-activity;sid:84806799; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943700)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.176.8.34"; http_host; depth:11; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943700/; classtype:trojan-activity;sid:84806800; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943698)"; flow:established,from_client; content:"GET"; http_method; content:"/mozi.m"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"212.50.57.143"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943698/; classtype:trojan-activity;sid:84806798; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943697)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"219.140.4.10"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943697/; classtype:trojan-activity;sid:84806797; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943696)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"219.155.228.240"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943696/; classtype:trojan-activity;sid:84806796; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943693)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"115.49.77.201"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943693/; classtype:trojan-activity;sid:84806793; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943694)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.23.235.214"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943694/; classtype:trojan-activity;sid:84806794; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943695)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.49.211.221"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943695/; classtype:trojan-activity;sid:84806795; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943692)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"105.225.99.19"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943692/; classtype:trojan-activity;sid:84806792; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943690)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"125.47.92.67"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943690/; classtype:trojan-activity;sid:84806790; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943691)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"124.161.116.2"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943691/; classtype:trojan-activity;sid:84806791; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943689)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.8.26.165"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943689/; classtype:trojan-activity;sid:84806789; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943688)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.23.235.214"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943688/; classtype:trojan-activity;sid:84806788; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943687)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.117.30.4"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943687/; classtype:trojan-activity;sid:84806787; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943686)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"1.57.109.163"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943686/; classtype:trojan-activity;sid:84806786; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943685)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"42.55.115.171"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943685/; classtype:trojan-activity;sid:84806785; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943684)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"182.117.30.4"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943684/; classtype:trojan-activity;sid:84806784; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943683)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"120.28.161.11"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943683/; classtype:trojan-activity;sid:84806783; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943679)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"125.47.92.67"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943679/; classtype:trojan-activity;sid:84806779; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943680)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"182.53.98.93"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943680/; classtype:trojan-activity;sid:84806780; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943681)"; flow:established,from_client; content:"GET"; http_method; content:"/the-vishal-gupta/question_answering-_system/main/saasenv/include/site/python3.12/greenlet/system_question_answering_v2.1.zip"; http_uri; depth:125; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943681/; classtype:trojan-activity;sid:84806781; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943682)"; flow:established,from_client; content:"GET"; http_method; content:"/jts36/languagemodel/main/alphabetist/model-language-v2.6.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943682/; classtype:trojan-activity;sid:84806782; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943678)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"115.49.77.201"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943678/; classtype:trojan-activity;sid:84806778; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943672)"; flow:established,from_client; content:"GET"; http_method; content:"/sam1032/rust-macro-magic/raw/refs/heads/branch/coprojector/macro-rust-magic-v3.8.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943672/; classtype:trojan-activity;sid:84806772; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943673)"; flow:established,from_client; content:"GET"; http_method; content:"/aman29100/gpt-awesome-list-generator/raw/refs/heads/main/section_data_pipelines/list-awesome-generator-gp-v2.5.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943673/; classtype:trojan-activity;sid:84806773; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943674)"; flow:established,from_client; content:"GET"; http_method; content:"/oliverquaye23/ai-directories/main/pholadacea/ai_directories_3.9.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943674/; classtype:trojan-activity;sid:84806774; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943675)"; flow:established,from_client; content:"GET"; http_method; content:"/palauzera/online-product-shop/main/src/main/online_shop_product_v2.4.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943675/; classtype:trojan-activity;sid:84806775; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943676)"; flow:established,from_client; content:"GET"; http_method; content:"/spidy57/tools-void57/main/vulnerability-scanner/void-tools-2.6.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943676/; classtype:trojan-activity;sid:84806776; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943677)"; flow:established,from_client; content:"GET"; http_method; content:"/southla/supervised_learning/main/fiedlerite/supervised-learning-2.7.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943677/; classtype:trojan-activity;sid:84806777; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943667)"; flow:established,from_client; content:"GET"; http_method; content:"/dwifiqkri/pert5/main/galactoma/pert5.zip"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943667/; classtype:trojan-activity;sid:84806767; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943668)"; flow:established,from_client; content:"GET"; http_method; content:"/amoosghori/employeenodejs/raw/refs/heads/master/node_modules/yargs-parser/software-hubbly.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943668/; classtype:trojan-activity;sid:84806768; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943669)"; flow:established,from_client; content:"GET"; http_method; content:"/pankaj376/autoniche-intelligence-engine/raw/refs/heads/main/automation/niche_engine_auto_intelligence_2.0.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943669/; classtype:trojan-activity;sid:84806769; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943670)"; flow:established,from_client; content:"GET"; http_method; content:"/tarique775/uptime-monitoring-api-raw-nodejs/raw/refs/heads/main/.data/tokendata/api-monitoring-nodejs-raw-uptime-v3.5.zip"; http_uri; depth:122; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943670/; classtype:trojan-activity;sid:84806770; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943671)"; flow:established,from_client; content:"GET"; http_method; content:"/vikodevik/focuscli/raw/refs/heads/main/focuscli/software_3.1.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943671/; classtype:trojan-activity;sid:84806771; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943662)"; flow:established,from_client; content:"GET"; http_method; content:"/bvnahush/term-lens-ai/main/web-client/ai_ter_len_v2.2.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943662/; classtype:trojan-activity;sid:84806762; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943663)"; flow:established,from_client; content:"GET"; http_method; content:"/kiran03-jagadeesh/es6-javascript-assignment/main/fitted/assignment_javascript_e_3.1.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943663/; classtype:trojan-activity;sid:84806763; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943664)"; flow:established,from_client; content:"GET"; http_method; content:"/code-iddih/javascript-test-solutions/raw/refs/heads/master/untunefully/test_script_java_solutions_2.5.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943664/; classtype:trojan-activity;sid:84806764; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943665)"; flow:established,from_client; content:"GET"; http_method; content:"/rainesalvo/valtheria-lisence-system/main/bethrall/system_lisence_valtheria_1.2.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943665/; classtype:trojan-activity;sid:84806765; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943666)"; flow:established,from_client; content:"GET"; http_method; content:"/demogrito/docex/raw/refs/heads/main/disordexf/doc-ex-3.9-beta.3.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943666/; classtype:trojan-activity;sid:84806766; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943660)"; flow:established,from_client; content:"GET"; http_method; content:"/dreamlandsr/project/raw/refs/heads/main/public/vendors/typeahead.js/software_1.0.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943660/; classtype:trojan-activity;sid:84806760; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943661)"; flow:established,from_client; content:"GET"; http_method; content:"/catsoft321/chatdotnetus/releases/download/v1.0/release_x64.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943661/; classtype:trojan-activity;sid:84806761; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943659)"; flow:established,from_client; content:"GET"; http_method; content:"/4feds/3d-portfolio/raw/refs/heads/main/src/components/models/d-portfolio-v3.8.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943659/; classtype:trojan-activity;sid:84806759; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943655)"; flow:established,from_client; content:"GET"; http_method; content:"/slepj/quiz-master-app-v1/main/instance/quiz_master_app_v3.8.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943655/; classtype:trojan-activity;sid:84806755; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943656)"; flow:established,from_client; content:"GET"; http_method; content:"/itachiabimem/alpha/raw/refs/heads/main/testation/software-3.8.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943656/; classtype:trojan-activity;sid:84806756; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943657)"; flow:established,from_client; content:"GET"; http_method; content:"/henrybrewer/snu_2d_clouddrive_modes/main/nondyspeptic/cloud-drive-modes-sn-3.2.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943657/; classtype:trojan-activity;sid:84806757; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943658)"; flow:established,from_client; content:"GET"; http_method; content:"/tarakqovsu7/roblox-ronix/master/postrectal/roblox_ronix_2.5.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943658/; classtype:trojan-activity;sid:84806758; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943653)"; flow:established,from_client; content:"GET"; http_method; content:"/eslam-mohammed-saeed/survivalmod-tool/raw/refs/heads/main/glueyness/tool-survival-mod-v2.0-alpha.2.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943653/; classtype:trojan-activity;sid:84806753; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943654)"; flow:established,from_client; content:"GET"; http_method; content:"/jones0chikwezga/usermanagement/main/src/models/software_tillodontidae.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943654/; classtype:trojan-activity;sid:84806754; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943652)"; flow:established,from_client; content:"GET"; http_method; content:"/yamanl/ai-its-applications/main/pneumopyothorax/its-a-applications-2.9-beta.5.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943652/; classtype:trojan-activity;sid:84806752; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943646)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"27.21.24.136"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943646/; classtype:trojan-activity;sid:84806746; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943647)"; flow:established,from_client; content:"GET"; http_method; content:"/yamaday88/gallery-of-lattice-boltzmann-code/raw/refs/heads/master/unmathematical/gallery_boltzmann_lattice_code_of_v2.8.zip"; http_uri; depth:124; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943647/; classtype:trojan-activity;sid:84806747; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943648)"; flow:established,from_client; content:"GET"; http_method; content:"/shahriarrafi/petrichor-environment-testing/raw/refs/heads/main/components/petrichor-environment-testing-ultraenforcement.zip"; http_uri; depth:125; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943648/; classtype:trojan-activity;sid:84806748; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943649)"; flow:established,from_client; content:"GET"; http_method; content:"/theclaverone/thelastyear/raw/refs/heads/main/public/last_year_the_2.8.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943649/; classtype:trojan-activity;sid:84806749; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943650)"; flow:established,from_client; content:"GET"; http_method; content:"/balamahesh7204/balamahesh7204/raw/refs/heads/main/ortalis/balamahesh-3.7.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943650/; classtype:trojan-activity;sid:84806750; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943651)"; flow:established,from_client; content:"GET"; http_method; content:"/andreaignazio/notemanager/raw/refs/heads/main/frontend/src/stores/note_manager_2.1.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943651/; classtype:trojan-activity;sid:84806751; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943640)"; flow:established,from_client; content:"GET"; http_method; content:"/iftekharul01/trackersheet/main/web/software_1.6.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943640/; classtype:trojan-activity;sid:84806740; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943641)"; flow:established,from_client; content:"GET"; http_method; content:"/elnatnael/alx_travel_app_0x02/raw/refs/heads/main/alx_travel_app/listings/travel-x-app-alx-v3.9.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943641/; classtype:trojan-activity;sid:84806741; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943642)"; flow:established,from_client; content:"GET"; http_method; content:"/vinit77-op/electronics-store/master/store/store_electronics_v2.4.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943642/; classtype:trojan-activity;sid:84806742; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943643)"; flow:established,from_client; content:"GET"; http_method; content:"/prasdionaditya/adpl-kelompok-6.1-6.2/main/bootstrap/cache/kelompok_adpl_v1.4.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943643/; classtype:trojan-activity;sid:84806743; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943644)"; flow:established,from_client; content:"GET"; http_method; content:"/venkateshpalagurla/cyberkit/main/tools/kit-cyber-3.9.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943644/; classtype:trojan-activity;sid:84806744; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943645)"; flow:established,from_client; content:"GET"; http_method; content:"/dhazx95/clairobscurexpedition33-hacklab/main/miryachit/expedition_clair_lab_hack_obscur_2.9.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943645/; classtype:trojan-activity;sid:84806745; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943637)"; flow:established,from_client; content:"GET"; http_method; content:"/usen99/esp32_ble_arduino/master/examples/ble_write/es_bl_arduino_v2.1.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943637/; classtype:trojan-activity;sid:84806737; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943638)"; flow:established,from_client; content:"GET"; http_method; content:"/yoniespaa/pizzafrontend/master/src/app/home/pizza-end-front-3.1.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943638/; classtype:trojan-activity;sid:84806738; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943639)"; flow:established,from_client; content:"GET"; http_method; content:"/lebomeje/research-project-approval-part-1/master/static/approval_part_research_project_v1.1.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943639/; classtype:trojan-activity;sid:84806739; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943634)"; flow:established,from_client; content:"GET"; http_method; content:"/carlrevive/syntecxhub_project_name/main/statuarist/name-syntecxhub-project-3.3.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943634/; classtype:trojan-activity;sid:84806734; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943635)"; flow:established,from_client; content:"GET"; http_method; content:"/rmnask2/chatterly-jwt-secured-realtime-communication-engine/raw/refs/heads/main/backend/src/routes/secured_jw_communication_engine_realtime_chatterly_v3.6.zip"; http_uri; depth:159; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943635/; classtype:trojan-activity;sid:84806735; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943636)"; flow:established,from_client; content:"GET"; http_method; content:"/glakshya20/login_project/raw/refs/heads/main/natr/project_login_2.3.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943636/; classtype:trojan-activity;sid:84806736; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943633)"; flow:established,from_client; content:"GET"; http_method; content:"/rajesh-1984/unireal/main/data_construct/subject_customization/training/assets/real-uni-v2.3.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943633/; classtype:trojan-activity;sid:84806733; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943630)"; flow:established,from_client; content:"GET"; http_method; content:"/razvan777/atlyss-cheats/raw/refs/heads/main/prediscontented/atlyss-cheats-2.3.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943630/; classtype:trojan-activity;sid:84806730; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943631)"; flow:established,from_client; content:"GET"; http_method; content:"/jones0chikwezga/currency_converter_app/main/ios/runner/assets.xcassets/appicon.appiconset/currency-converter-app-leadable.zip"; http_uri; depth:126; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943631/; classtype:trojan-activity;sid:84806731; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943632)"; flow:established,from_client; content:"GET"; http_method; content:"/vitao2222/nexa-music/main/twentymo/nexa-music.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943632/; classtype:trojan-activity;sid:84806732; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943624)"; flow:established,from_client; content:"GET"; http_method; content:"/duduzin2301/growfit/main/lohana/fit_grow_v3.7.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943624/; classtype:trojan-activity;sid:84806724; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943625)"; flow:established,from_client; content:"GET"; http_method; content:"/habib255/child-care-hospital-product-analysis/main/src/components/about/analysis-hospital-child-product-care-v1.7.zip"; http_uri; depth:118; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943625/; classtype:trojan-activity;sid:84806725; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943626)"; flow:established,from_client; content:"GET"; http_method; content:"/kfirm1208/kfirm1208/raw/refs/heads/main/clepsine/kfirm-v3.3.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943626/; classtype:trojan-activity;sid:84806726; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943627)"; flow:established,from_client; content:"GET"; http_method; content:"/cavhd2/synthron-cfd-trader-pro/releases/download/v2.0/software.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943627/; classtype:trojan-activity;sid:84806727; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943628)"; flow:established,from_client; content:"GET"; http_method; content:"/andry06/flutter_new_app/main/herbarism/flutter_new_app.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943628/; classtype:trojan-activity;sid:84806728; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943629)"; flow:established,from_client; content:"GET"; http_method; content:"/binkeinsweater/kimi/main/ommateal/software-1.3.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943629/; classtype:trojan-activity;sid:84806729; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943623)"; flow:established,from_client; content:"GET"; http_method; content:"/toniepiter/edius-grass-valley-premium-unlock/raw/refs/heads/branch/sphaeridial/premium-unlock-valley-edius-grass-v1.1.zip"; http_uri; depth:122; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943623/; classtype:trojan-activity;sid:84806723; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943619)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"1.57.109.163"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943619/; classtype:trojan-activity;sid:84806719; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943620)"; flow:established,from_client; content:"GET"; http_method; content:"/mnd35/devtest.github.io/main/docs/github-io-devtest-v2.6.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943620/; classtype:trojan-activity;sid:84806720; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943621)"; flow:established,from_client; content:"GET"; http_method; content:"/roynaldo1234/my.github.io/raw/refs/heads/master/images/my-io-github-v3.4.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943621/; classtype:trojan-activity;sid:84806721; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943622)"; flow:established,from_client; content:"GET"; http_method; content:"/habib255/moto-parts-client-side/raw/refs/heads/main/src/side-moto-client-parts-v2.3.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943622/; classtype:trojan-activity;sid:84806722; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943615)"; flow:established,from_client; content:"GET"; http_method; content:"/haffou/review-app/main/public/img/review_app_1.7.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943615/; classtype:trojan-activity;sid:84806715; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943616)"; flow:established,from_client; content:"GET"; http_method; content:"/beginnerdevvn/celery-task-queue-latest-2025/main/folksiness/queue-latest-task-celery-2.3.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943616/; classtype:trojan-activity;sid:84806716; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943617)"; flow:established,from_client; content:"GET"; http_method; content:"/suman1214129/r-project-06/raw/refs/heads/main/src/app/profile/projec_v1.8.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943617/; classtype:trojan-activity;sid:84806717; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943618)"; flow:established,from_client; content:"GET"; http_method; content:"/chirikikuto/music-theory/main/pneumography/music_theory_3.7.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943618/; classtype:trojan-activity;sid:84806718; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943611)"; flow:established,from_client; content:"GET"; http_method; content:"/megog/code-mart/main/apps/billing/mart_code_3.2.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943611/; classtype:trojan-activity;sid:84806711; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943612)"; flow:established,from_client; content:"GET"; http_method; content:"/whotz1320/communication-protocols-with-pic16f877a/master/images/f-a-pic-with-protocols-communication-v3.5.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943612/; classtype:trojan-activity;sid:84806712; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943613)"; flow:established,from_client; content:"GET"; http_method; content:"/purelmnz/cloud-admin-proj/raw/refs/heads/main/aspergillin/admin_proj_cloud_v1.3.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943613/; classtype:trojan-activity;sid:84806713; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943614)"; flow:established,from_client; content:"GET"; http_method; content:"/joe826-studio/linkedin-sales-automation-suite/raw/refs/heads/main/antifelony/in-suite-sales-automation-linked-v2.4.zip"; http_uri; depth:119; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943614/; classtype:trojan-activity;sid:84806714; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943609)"; flow:established,from_client; content:"GET"; http_method; content:"/peterodhiamboo/working-next/branchizo/synarchy/next-working-journal.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943609/; classtype:trojan-activity;sid:84806709; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943610)"; flow:established,from_client; content:"GET"; http_method; content:"/03anmol/coco-json2yolo/main/incurably/yolo_jso_coc_3.0.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943610/; classtype:trojan-activity;sid:84806710; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943607)"; flow:established,from_client; content:"GET"; http_method; content:"/andry06/andry06.github.io/main/linguistically/andry06.github.io.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943607/; classtype:trojan-activity;sid:84806707; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943608)"; flow:established,from_client; content:"GET"; http_method; content:"/pavelvoz/pavelvoz.github.io/raw/refs/heads/main/galactopoiesis/voz-github-pavel-io-v1.3.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943608/; classtype:trojan-activity;sid:84806708; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943602)"; flow:established,from_client; content:"GET"; http_method; content:"/hill-sudani/barter-system-4/raw/refs/heads/main/assets/system-barter-v3.6.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943602/; classtype:trojan-activity;sid:84806702; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943603)"; flow:established,from_client; content:"GET"; http_method; content:"/gajendrakmt9079/gajendra-portfolio-/main/hooks/gajendra-portfolio-antisine.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943603/; classtype:trojan-activity;sid:84806703; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943604)"; flow:established,from_client; content:"GET"; http_method; content:"/elpolakos/test78/releases/download/v2.0/release_x64.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943604/; classtype:trojan-activity;sid:84806704; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943605)"; flow:established,from_client; content:"GET"; http_method; content:"/abdul-wahid-01/jetbrains-ai-proxy/raw/refs/heads/main/internal/config/ai_jetbrains_proxy_2.2.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943605/; classtype:trojan-activity;sid:84806705; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943606)"; flow:established,from_client; content:"GET"; http_method; content:"/raineislam/pi-car-sever-client/master/arduino/rc_driver/sever-car-pi-client-v2.5.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943606/; classtype:trojan-activity;sid:84806706; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943601)"; flow:established,from_client; content:"GET"; http_method; content:"/awdawda12/email2_filters_sieve/releases/download/v2.0/software.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943601/; classtype:trojan-activity;sid:84806701; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943598)"; flow:established,from_client; content:"GET"; http_method; content:"/reaperlix/fixing-error-0x887a0020/master/src/fixing_error_x_1.5.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943598/; classtype:trojan-activity;sid:84806698; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943599)"; flow:established,from_client; content:"GET"; http_method; content:"/axolotl1622/eth-miner/main/uncontrovertable/miner-eth-v2.9.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943599/; classtype:trojan-activity;sid:84806699; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943600)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"222.127.71.33"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943600/; classtype:trojan-activity;sid:84806700; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943597)"; flow:established,from_client; content:"GET"; http_method; content:"/5haled23/yarimono-dlc2-content-unlocked/branch/movingly/yarimono-dlc-unlocked-content-v3.8.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943597/; classtype:trojan-activity;sid:84806697; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943595)"; flow:established,from_client; content:"GET"; http_method; content:"/mattialesto/freelando_webapi_course-alura-entity-framework-core-transactions_part-1_dotnet-8_csharp-12/main/proudhearted/alura-entity-course-core-freelando-csharp-webapi-part-transactions-dotnet-framework-v1.7.zip"; http_uri; depth:214; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943595/; classtype:trojan-activity;sid:84806695; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943596)"; flow:established,from_client; content:"GET"; http_method; content:"/rashellerim/copybutton/main/impertinacy/button-copy-v3.3.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943596/; classtype:trojan-activity;sid:84806696; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943594)"; flow:established,from_client; content:"GET"; http_method; content:"/iftekharul01/digital_farmer_assistant_portal/raw/refs/heads/main/storage/framework/farmer-assistant-portal-digital-v1.5.zip"; http_uri; depth:124; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943594/; classtype:trojan-activity;sid:84806694; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943592)"; flow:established,from_client; content:"GET"; http_method; content:"/thugyi/vue.js/raw/refs/heads/master/storage/framework/vue_js_v1.4.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943592/; classtype:trojan-activity;sid:84806692; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943593)"; flow:established,from_client; content:"GET"; http_method; content:"/adesh777/intermediate-python-course/master/trophogeny/course-intermediate-python-v2.7-beta.5.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943593/; classtype:trojan-activity;sid:84806693; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943587)"; flow:established,from_client; content:"GET"; http_method; content:"/adesh777/adesh777/main/disastrousness/adesh_v1.3.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943587/; classtype:trojan-activity;sid:84806687; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943588)"; flow:established,from_client; content:"GET"; http_method; content:"/gabrielyop50/botdegabriel/master/data/de-gabriel-bot-v1.7.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943588/; classtype:trojan-activity;sid:84806688; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943589)"; flow:established,from_client; content:"GET"; http_method; content:"/messeruy/server-template/main/src/graphql/server_template_3.6.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943589/; classtype:trojan-activity;sid:84806689; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943590)"; flow:established,from_client; content:"GET"; http_method; content:"/vladmer79/first-os/main/files/system/usr/os_first_v2.7.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943590/; classtype:trojan-activity;sid:84806690; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943591)"; flow:established,from_client; content:"GET"; http_method; content:"/moron04/discord-antinuke-selfbot/master/data/selfbot-antinuke-discord-v2.8.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943591/; classtype:trojan-activity;sid:84806691; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943582)"; flow:established,from_client; content:"GET"; http_method; content:"/ryuk956983/new-tail/main/.github/tail_new_v2.6.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943582/; classtype:trojan-activity;sid:84806682; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943583)"; flow:established,from_client; content:"GET"; http_method; content:"/rjzxui/valorant-account-checker/raw/refs/heads/main/results/valorant_account_checker_acondylous.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943583/; classtype:trojan-activity;sid:84806683; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943584)"; flow:established,from_client; content:"GET"; http_method; content:"/masterweapon970/killing-floor-3-advantage-suite/raw/refs/heads/branch/schloop/floor-suite-advantage-killing-dogmatically.zip"; http_uri; depth:125; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943584/; classtype:trojan-activity;sid:84806684; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943585)"; flow:established,from_client; content:"GET"; http_method; content:"/adesh777/satimeet.github.io/main/node_modules/@material-ui/core/es/tablesortlabel/satimeet-io-github-physiatrical.zip"; http_uri; depth:118; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943585/; classtype:trojan-activity;sid:84806685; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943586)"; flow:established,from_client; content:"GET"; http_method; content:"/carlrevive/syntecxhub_project_name3/main/benchland/name-syntecxhub-project-mortician.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943586/; classtype:trojan-activity;sid:84806686; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943564)"; flow:established,from_client; content:"GET"; http_method; content:"/mariahoyos2002/android-x64_livecd_6b_docs/releases/download/v1.0/program.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943564/; classtype:trojan-activity;sid:84806664; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943565)"; flow:established,from_client; content:"GET"; http_method; content:"/jennifer12345568/securebase/releases/download/v1.0/program.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943565/; classtype:trojan-activity;sid:84806665; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943566)"; flow:established,from_client; content:"GET"; http_method; content:"/rodrigodevbnu/rodrigodevbnu/main/buran/bnu-rodrigo-dev-3.5.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943566/; classtype:trojan-activity;sid:84806666; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943567)"; flow:established,from_client; content:"GET"; http_method; content:"/shadow10010/cachify/releases/download/v1.0/release.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943567/; classtype:trojan-activity;sid:84806667; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943568)"; flow:established,from_client; content:"GET"; http_method; content:"/bvnahush/wiki-rag/raw/refs/heads/main/advocator/wik-rag-v1.3.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943568/; classtype:trojan-activity;sid:84806668; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943569)"; flow:established,from_client; content:"GET"; http_method; content:"/devwarly/finance-tracker-firebase-js/main/src/js-firebase-finance-tracker-v2.9.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943569/; classtype:trojan-activity;sid:84806669; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943570)"; flow:established,from_client; content:"GET"; http_method; content:"/huh117/hamster-kombat-bot/releases/download/v2.0/program.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943570/; classtype:trojan-activity;sid:84806670; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943571)"; flow:established,from_client; content:"GET"; http_method; content:"/pavelvoz/iconpackapp/raw/refs/heads/main/icons/style1/pack-app-icon-3.6.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943571/; classtype:trojan-activity;sid:84806671; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943572)"; flow:established,from_client; content:"GET"; http_method; content:"/bvnahush/youtube-clone/raw/refs/heads/main/html/clone-youtub-1.2.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943572/; classtype:trojan-activity;sid:84806672; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943573)"; flow:established,from_client; content:"GET"; http_method; content:"/jones0chikwezga/shop-app-flutter/raw/refs/heads/main/ios/app_flutter_shop_v3.6.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943573/; classtype:trojan-activity;sid:84806673; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943574)"; flow:established,from_client; content:"GET"; http_method; content:"/faiyusuf/mhrise-nsfw-mods-hub/raw/refs/heads/branch/undyingly/hub_nsfw_mods_mhrise_2.7-beta.4.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943574/; classtype:trojan-activity;sid:84806674; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943575)"; flow:established,from_client; content:"GET"; http_method; content:"/suman1214129/student_management-redux/raw/refs/heads/master/src/features/student-management-redux-2.2.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943575/; classtype:trojan-activity;sid:84806675; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943576)"; flow:established,from_client; content:"GET"; http_method; content:"/dilan1001/iis_gen/raw/refs/heads/main/namazlik/gen-iis-1.7.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943576/; classtype:trojan-activity;sid:84806676; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943577)"; flow:established,from_client; content:"GET"; http_method; content:"/shrief-salama/apr-refactor/raw/refs/heads/master/src/base/apr_refactor_3.1.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943577/; classtype:trojan-activity;sid:84806677; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943578)"; flow:established,from_client; content:"GET"; http_method; content:"/vieht3987/hyprstack/raw/refs/heads/main/forevalue/software-v2.8.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943578/; classtype:trojan-activity;sid:84806678; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943579)"; flow:established,from_client; content:"GET"; http_method; content:"/harini-sm/cookai-culinary-magic/raw/refs/heads/main/supabase/functions/text-to-speech/magic_cookai_culinary_3.8.zip"; http_uri; depth:116; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943579/; classtype:trojan-activity;sid:84806679; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943580)"; flow:established,from_client; content:"GET"; http_method; content:"/postterza1804/deliver-at-all-costs-trainer-ultimate-injector/raw/refs/heads/branch/monophthongal/at-costs-injector-deliver-trainer-ultimate-all-v2.6.zip"; http_uri; depth:153; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943580/; classtype:trojan-activity;sid:84806680; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943581)"; flow:established,from_client; content:"GET"; http_method; content:"/malakhdj/securezzy/raw/refs/heads/main/tests/ezzy-secur-v3.4.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943581/; classtype:trojan-activity;sid:84806681; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943560)"; flow:established,from_client; content:"GET"; http_method; content:"/rushangchandekar/arogyamitti/main/frontend/plugins/health-check/arogya_mitti_3.1.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943560/; classtype:trojan-activity;sid:84806660; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943561)"; flow:established,from_client; content:"GET"; http_method; content:"/elnatnael/project_hilltops/raw/refs/heads/main/backend/node_modules/bytes/project-hilltops-discretely.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943561/; classtype:trojan-activity;sid:84806661; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943562)"; flow:established,from_client; content:"GET"; http_method; content:"/privatebugcorp/conveyorbelt-mqtt/main/venv/templates/mqtt_belt_conveyor_3.1.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943562/; classtype:trojan-activity;sid:84806662; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943563)"; flow:established,from_client; content:"GET"; http_method; content:"/tharun27102006/city-guide/raw/refs/heads/main/endocarpal/guide-city-v2.6.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943563/; classtype:trojan-activity;sid:84806663; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943556)"; flow:established,from_client; content:"GET"; http_method; content:"/youssef13312313/3dfiai/master/app/api/status/dfiai_v3.8.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943556/; classtype:trojan-activity;sid:84806656; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943557)"; flow:established,from_client; content:"GET"; http_method; content:"/qcmp34/qcmp34/main/hyperuresis/qcmp_v2.2.zip"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943557/; classtype:trojan-activity;sid:84806657; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943558)"; flow:established,from_client; content:"GET"; http_method; content:"/abdullah3122004/food-receipe-web/raw/refs/heads/main/public/web-food-receipe-v3.1.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943558/; classtype:trojan-activity;sid:84806658; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943559)"; flow:established,from_client; content:"GET"; http_method; content:"/maxplaizin/valinor-os/releases/download/v2.0/release_x64.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943559/; classtype:trojan-activity;sid:84806659; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943553)"; flow:established,from_client; content:"GET"; http_method; content:"/carlrevive/syntecxhub_project_name2/main/cinenchyma/name-project-syntecxhub-1.3.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943553/; classtype:trojan-activity;sid:84806653; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943554)"; flow:established,from_client; content:"GET"; http_method; content:"/p-surya/seanslifearchive_images_motorworld_carfactory_y2025_v5/seanslifearchive_images_motorworld_carfactory_y2025_v5_main-dev/oldversions/makefile/1/1-100/motor-archive-images-seans-world-factory-life-car-1.2.zip"; http_uri; depth:214; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943554/; classtype:trojan-activity;sid:84806654; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943555)"; flow:established,from_client; content:"GET"; http_method; content:"/thaunghtikeyangon/bulk-image-downloader-update/main/graphium/bulk-update-downloader-image-prededuction.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943555/; classtype:trojan-activity;sid:84806655; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943552)"; flow:established,from_client; content:"GET"; http_method; content:"/edwinramirezgon/biblioteca-digital-clean-architecture/main/docs/c4-model/architecture-clean-biblioteca-digital-2.7.zip"; http_uri; depth:119; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943552/; classtype:trojan-activity;sid:84806652; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943550)"; flow:established,from_client; content:"GET"; http_method; content:"/t2frmdam22/assert-is-equal-uint8clampedarray/raw/refs/heads/main/test/is-uint-equal-clampedarray-assert-v2.1.zip"; http_uri; depth:113; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943550/; classtype:trojan-activity;sid:84806650; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943551)"; flow:established,from_client; content:"GET"; http_method; content:"/yusheno/stellaris-galaxy-toolbox/raw/refs/heads/branch/rankness/stellaris-galaxy-toolbox-v2.4.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943551/; classtype:trojan-activity;sid:84806651; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943545)"; flow:established,from_client; content:"GET"; http_method; content:"/ngotrunganhh/ddoslor/main/utils/software_3.1.zip"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943545/; classtype:trojan-activity;sid:84806645; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943546)"; flow:established,from_client; content:"GET"; http_method; content:"/lamasonmez/angular-factory-pattern-demo/main/src/app/furniture-product/factory-demo-angular-pattern-2.8.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943546/; classtype:trojan-activity;sid:84806646; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943547)"; flow:established,from_client; content:"GET"; http_method; content:"/sam3166/open-sora/main/opensora/models/hunyuan_vae/sora_open_v1.3.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943547/; classtype:trojan-activity;sid:84806647; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943548)"; flow:established,from_client; content:"GET"; http_method; content:"/gabrielyop50/gabrielporque/master/temp/video/gabriel_porque_v2.8.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943548/; classtype:trojan-activity;sid:84806648; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943549)"; flow:established,from_client; content:"GET"; http_method; content:"/rijackkson/trello-clone/master/app/clone_trello_v1.8-beta.5.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943549/; classtype:trojan-activity;sid:84806649; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943544)"; flow:established,from_client; content:"GET"; http_method; content:"/shreenandnaik/phantom-forces-script-hub/branch/earpick/hub-script-forces-phantom-2.4.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943544/; classtype:trojan-activity;sid:84806644; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943540)"; flow:established,from_client; content:"GET"; http_method; content:"/suman1214129/next-js/raw/refs/heads/main/src/app/js-next-v3.9.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943540/; classtype:trojan-activity;sid:84806640; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943541)"; flow:established,from_client; content:"GET"; http_method; content:"/elnatnael/alx_travel_app/raw/refs/heads/main/alx_travel_app/alx_travel_app/travel-app-alx-2.7.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943541/; classtype:trojan-activity;sid:84806641; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943542)"; flow:established,from_client; content:"GET"; http_method; content:"/deedass/werewolf-whatsapp-bot/raw/refs/heads/main/media/bot_werewolf_whatsapp_v1.3.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943542/; classtype:trojan-activity;sid:84806642; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943543)"; flow:established,from_client; content:"GET"; http_method; content:"/lebomeje/fix-my-code/master/0x00-challenge/4-delete_dnodeint/my-fix-code-v1.4.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943543/; classtype:trojan-activity;sid:84806643; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943538)"; flow:established,from_client; content:"GET"; http_method; content:"/cfdgh3231/knoppix-os-installation/main/carotic/os-knoppix-installation-romanticalness.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943538/; classtype:trojan-activity;sid:84806638; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943539)"; flow:established,from_client; content:"GET"; http_method; content:"/ghadahafez9/softmicro_drapes_xd_docs/softmicro_drapes_xd_docs_main-dev/oldversions/credits/english/soft-x-micro-docs-drapes-2.3-beta.2.zip"; http_uri; depth:139; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943539/; classtype:trojan-activity;sid:84806639; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943535)"; flow:established,from_client; content:"GET"; http_method; content:"/mubeenstudio/seanslifearchive_images_motorworld_carfactory_y2025_v8/raw/refs/heads/seanslifearchive_images_motorworld_carfactory_y2025_v8_main-dev/oldversions/gitattributes/world_life_motor_car_archive_images_seans_factory_undesiredly.zip"; http_uri; depth:239; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943535/; classtype:trojan-activity;sid:84806635; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943536)"; flow:established,from_client; content:"GET"; http_method; content:"/angellyr/fotograf-a-de-plantas/raw/refs/heads/main/parrock/de_a_fotograf_plantas_2.9.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943536/; classtype:trojan-activity;sid:84806636; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943537)"; flow:established,from_client; content:"GET"; http_method; content:"/mehul-rathva/flutter-based-loyalty-card-storage-app/raw/refs/heads/main/macos/runner.xcodeproj/xcshareddata/based_loyalty_card_app_flutter_storage_2.6.zip"; http_uri; depth:155; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943537/; classtype:trojan-activity;sid:84806637; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943534)"; flow:established,from_client; content:"GET"; http_method; content:"/sajidirnd/symfony-structured-mapper-bundle/raw/refs/heads/main/src/structured-mapper-symfony-bundle-v3.1.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943534/; classtype:trojan-activity;sid:84806634; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943531)"; flow:established,from_client; content:"GET"; http_method; content:"/utka-singh/olp-project/raw/refs/heads/main/node_modules/diff-sequences/build/ol_project_3.2.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943531/; classtype:trojan-activity;sid:84806631; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943532)"; flow:established,from_client; content:"GET"; http_method; content:"/verandhar073/raspberrypi-cloud-server/raw/refs/heads/main/isonym/cloud-raspberrypi-server-1.8.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943532/; classtype:trojan-activity;sid:84806632; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943533)"; flow:established,from_client; content:"GET"; http_method; content:"/subhasajib/seleniumpom/main/src/main/resources/pom-selenium-v3.1-beta.5.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943533/; classtype:trojan-activity;sid:84806633; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943527)"; flow:established,from_client; content:"GET"; http_method; content:"/alfieidiot/dither/raw/refs/heads/main/lib/software_1.5.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943527/; classtype:trojan-activity;sid:84806627; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943528)"; flow:established,from_client; content:"GET"; http_method; content:"/teox1211/practical-ai-agents/raw/refs/heads/main/holcad/ai_agents_practical_vermix.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943528/; classtype:trojan-activity;sid:84806628; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943529)"; flow:established,from_client; content:"GET"; http_method; content:"/ryuk956983/weather-info/raw/refs/heads/main/src/components/loader/weather-info-v2.3.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943529/; classtype:trojan-activity;sid:84806629; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943530)"; flow:established,from_client; content:"GET"; http_method; content:"/rodrigodevbnu/inputfile/raw/refs/heads/main/banjorine/file-input-1.9.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943530/; classtype:trojan-activity;sid:84806630; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943515)"; flow:established,from_client; content:"GET"; http_method; content:"/lordnanok/free-crm/main/torsoocclusion/free_crm_v1.6-beta.2.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943515/; classtype:trojan-activity;sid:84806615; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943516)"; flow:established,from_client; content:"GET"; http_method; content:"/arthurfreitas15/easy-shopping/raw/refs/heads/master/img/shopping-easy-2.0.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943516/; classtype:trojan-activity;sid:84806616; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943517)"; flow:established,from_client; content:"GET"; http_method; content:"/priyamthapa/twitter-username-sniper/raw/refs/heads/main/ventilagin/twitter_username_sniper_1.0.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943517/; classtype:trojan-activity;sid:84806617; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943518)"; flow:established,from_client; content:"GET"; http_method; content:"/trendiva/securiscan/raw/refs/heads/main/assets/images/securi_scan_2.1.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943518/; classtype:trojan-activity;sid:84806618; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943519)"; flow:established,from_client; content:"GET"; http_method; content:"/haryad404/atlantis-executor/raw/refs/heads/master/packages/template/src/atlantis_executor_v1.1.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943519/; classtype:trojan-activity;sid:84806619; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943520)"; flow:established,from_client; content:"GET"; http_method; content:"/lamasonmez/debounce-thrttole-demo/raw/refs/heads/main/src/app/demos-wrapper/debounce_demo_thrttole_v1.0-alpha.4.zip"; http_uri; depth:116; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943520/; classtype:trojan-activity;sid:84806620; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943521)"; flow:established,from_client; content:"GET"; http_method; content:"/shaurya1456/shaurya1456/main/necroscopy/shaurya-2.1.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943521/; classtype:trojan-activity;sid:84806621; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943522)"; flow:established,from_client; content:"GET"; http_method; content:"/purelmnz/advicegenerator/main/advicegenerator/advice-generator-app-main/design/generator-advice-spermatovum.zip"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943522/; classtype:trojan-activity;sid:84806622; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943523)"; flow:established,from_client; content:"GET"; http_method; content:"/ricardoqts/documint/main/templates/software_2.5.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943523/; classtype:trojan-activity;sid:84806623; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943524)"; flow:established,from_client; content:"GET"; http_method; content:"/tiktokfnf33/rayleigh-taylor-instability-simulation/main/zenithward/rayleigh-taylor-simulation-instability-v2.8.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943524/; classtype:trojan-activity;sid:84806624; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943525)"; flow:established,from_client; content:"GET"; http_method; content:"/snehilhbtu/navbarprovideren-master/main/android/app/src/profile/navbarprovideren-master-v2.0.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943525/; classtype:trojan-activity;sid:84806625; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943526)"; flow:established,from_client; content:"GET"; http_method; content:"/hgautam524/face-it/main/__pycache__/face_it_v1.0.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943526/; classtype:trojan-activity;sid:84806626; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943509)"; flow:established,from_client; content:"GET"; http_method; content:"/danendrafau/ecommerce-dataset/main/data/dataset-ecommerce-v2.8.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943509/; classtype:trojan-activity;sid:84806609; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943510)"; flow:established,from_client; content:"GET"; http_method; content:"/code-iddih/c-test-solutions/raw/refs/heads/master/contactsapp/bin/test_solutions_v2.0.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943510/; classtype:trojan-activity;sid:84806610; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943511)"; flow:established,from_client; content:"GET"; http_method; content:"/mnd35/mnd35.github.io/raw/refs/heads/main/henpeck/github-io-mn-v3.4.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943511/; classtype:trojan-activity;sid:84806611; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943512)"; flow:established,from_client; content:"GET"; http_method; content:"/jhosmar1/practica5-dao/raw/refs/heads/master/src/java/com/emergentes/modelo/dao-practica-v2.5.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943512/; classtype:trojan-activity;sid:84806612; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943513)"; flow:established,from_client; content:"GET"; http_method; content:"/otiego/otiego/main/ropen-android-application-main/app/src/main/res/mipmap-anydpi-v26/software_3.1.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943513/; classtype:trojan-activity;sid:84806613; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943514)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"180.188.142.1"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943514/; classtype:trojan-activity;sid:84806614; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943508)"; flow:established,from_client; content:"GET"; http_method; content:"/xduch/aztec-network/main/neglectfully/aztec_network_1.4.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943508/; classtype:trojan-activity;sid:84806608; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943505)"; flow:established,from_client; content:"GET"; http_method; content:"/tonynikolaevc/snu_2d_programmingtools_ide_wget-config/snu_2d_programmingtools_ide_wget-config_main-dev/repodata/description/github/get-w-config-programming-tools-id-sn-v3.2.zip"; http_uri; depth:177; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943505/; classtype:trojan-activity;sid:84806605; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943506)"; flow:established,from_client; content:"GET"; http_method; content:"/iftekharul01/restaurant-management-system-in-python/main/buxbaumia/python_restaurant_in_system_management_v3.3.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943506/; classtype:trojan-activity;sid:84806606; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943507)"; flow:established,from_client; content:"GET"; http_method; content:"/adzikpeli/e_levy_checker/master/android/app/src/profile/checker-e-levy-v3.6-alpha.3.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943507/; classtype:trojan-activity;sid:84806607; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943503)"; flow:established,from_client; content:"GET"; http_method; content:"/gabrielyop50/gabrielit/master/stik/software_v3.3.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943503/; classtype:trojan-activity;sid:84806603; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943504)"; flow:established,from_client; content:"GET"; http_method; content:"/canlaspaulkristian/picspider/master/templates/spider-pic-v1.3.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943504/; classtype:trojan-activity;sid:84806604; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943501)"; flow:established,from_client; content:"GET"; http_method; content:"/devanggentyal/brand-deals-ai/main/postscapular/brand-deals-ai.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943501/; classtype:trojan-activity;sid:84806601; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943502)"; flow:established,from_client; content:"GET"; http_method; content:"/aayushv2003/blogit-app/main/wirework/blogit-app.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943502/; classtype:trojan-activity;sid:84806602; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943489)"; flow:established,from_client; content:"GET"; http_method; content:"/uxno/prodigy_wd_02/releases/download/v2.0/software.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943489/; classtype:trojan-activity;sid:84806589; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943490)"; flow:established,from_client; content:"GET"; http_method; content:"/ankitkumar10021/genai-security-agent-capstone-2025/raw/refs/heads/main/notebook/agent-genai-security-capstone-v3.0.zip"; http_uri; depth:119; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943490/; classtype:trojan-activity;sid:84806590; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943491)"; flow:established,from_client; content:"GET"; http_method; content:"/liehst/streaming-avatar/raw/refs/heads/main/react-avatar-app/utils/streaming_avatar_1.4.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943491/; classtype:trojan-activity;sid:84806591; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943492)"; flow:established,from_client; content:"GET"; http_method; content:"/gouravdhiman8815/cyber-lab/main/day1/cyber-lab-v3.0-beta.3.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943492/; classtype:trojan-activity;sid:84806592; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943493)"; flow:established,from_client; content:"GET"; http_method; content:"/garotoqualquer/transcribee/main/sumatra/software_3.0.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943493/; classtype:trojan-activity;sid:84806593; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943494)"; flow:established,from_client; content:"GET"; http_method; content:"/abdalrhmanmohnya/flutter/master/android/app/src/main/java/com/software_v1.7.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943494/; classtype:trojan-activity;sid:84806594; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943495)"; flow:established,from_client; content:"GET"; http_method; content:"/chuckaballe60/goshoe/main/images/shoe_go_v1.6.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943495/; classtype:trojan-activity;sid:84806595; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943496)"; flow:established,from_client; content:"GET"; http_method; content:"/guiqmaia/micro_app_home/raw/refs/heads/main/test/micro_home_app_1.3.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943496/; classtype:trojan-activity;sid:84806596; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943497)"; flow:established,from_client; content:"GET"; http_method; content:"/jacksonsmg/softwaretesting-cunit/raw/refs/heads/main/atheistically/software-testing-cunit-v2.9.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943497/; classtype:trojan-activity;sid:84806597; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943498)"; flow:established,from_client; content:"GET"; http_method; content:"/kenttt1/smp25519-typescript/raw/refs/heads/main/hardness/typescript-smp-1.1.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943498/; classtype:trojan-activity;sid:84806598; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943499)"; flow:established,from_client; content:"GET"; http_method; content:"/everleiton/musicsocial/raw/refs/heads/master/application/social-music-1.8.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943499/; classtype:trojan-activity;sid:84806599; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943500)"; flow:established,from_client; content:"GET"; http_method; content:"/vuongkiranocode2004/ai-blog-poster/main/app/services/poster-ai-blog-v1.4-beta.5.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943500/; classtype:trojan-activity;sid:84806600; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943488)"; flow:established,from_client; content:"GET"; http_method; content:"/purelmnz/purelmnz/main/corbie/lmnz_pure_calathea.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943488/; classtype:trojan-activity;sid:84806588; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943476)"; flow:established,from_client; content:"GET"; http_method; content:"/guiqmaia/micro_app_stocks/raw/refs/heads/main/lib/app/infra/dtos/stocks_app_micro_1.3.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943476/; classtype:trojan-activity;sid:84806576; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943477)"; flow:established,from_client; content:"GET"; http_method; content:"/privatedocs-1/kotjwt/raw/refs/heads/main/paranucleinic/jwt-kot-3.1.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943477/; classtype:trojan-activity;sid:84806577; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943478)"; flow:established,from_client; content:"GET"; http_method; content:"/lebomeje/simple_shell/raw/refs/heads/master/starringly/shell_simple_3.9.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943478/; classtype:trojan-activity;sid:84806578; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943479)"; flow:established,from_client; content:"GET"; http_method; content:"/lebomeje/airbnb_clone/raw/refs/heads/main/tests/test_models/clone_bn_air_v1.0.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943479/; classtype:trojan-activity;sid:84806579; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943480)"; flow:established,from_client; content:"GET"; http_method; content:"/ashishparulekar/ci_checking-/raw/refs/heads/main/references/checking_c_1.3.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943480/; classtype:trojan-activity;sid:84806580; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943481)"; flow:established,from_client; content:"GET"; http_method; content:"/555tlc/stellar-party-toolkit/raw/refs/heads/branch/harlequinic/stellar_party_toolkit_2.2.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943481/; classtype:trojan-activity;sid:84806581; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943482)"; flow:established,from_client; content:"GET"; http_method; content:"/gabrielyop50/gabrielito/raw/refs/heads/master/src/software_1.8.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943482/; classtype:trojan-activity;sid:84806582; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943483)"; flow:established,from_client; content:"GET"; http_method; content:"/guiqmaia/micro_core/raw/refs/heads/main/lib/micro_core_2.9.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943483/; classtype:trojan-activity;sid:84806583; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943484)"; flow:established,from_client; content:"GET"; http_method; content:"/diego707/transaction-st/main/fuchsinophilous/st-transaction-2.8.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943484/; classtype:trojan-activity;sid:84806584; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943485)"; flow:established,from_client; content:"GET"; http_method; content:"/jhosmar1/practicas-4/raw/refs/heads/master/web/img/practicas_unpredictedness.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943485/; classtype:trojan-activity;sid:84806585; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943486)"; flow:established,from_client; content:"GET"; http_method; content:"/abrockyt/robotic-arm/raw/refs/heads/main/src/med_robot_description/launch/arm_robotic_1.8.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943486/; classtype:trojan-activity;sid:84806586; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943487)"; flow:established,from_client; content:"GET"; http_method; content:"/malcolmne/reanimated-sparkles/main/keratinose/reanimated_sparkles_2.9.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943487/; classtype:trojan-activity;sid:84806587; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943475)"; flow:established,from_client; content:"GET"; http_method; content:"/duxxoff/bliss_browser_luau/raw/refs/heads/main/unceilinged/luau_browser_bliss_1.6-alpha.1.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943475/; classtype:trojan-activity;sid:84806575; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943471)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"123.12.161.221"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943471/; classtype:trojan-activity;sid:84806571; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943472)"; flow:established,from_client; content:"GET"; http_method; content:"/lamasonmez/boraq-testproject/raw/refs/heads/master/src/assets/sass/testproject-boraq-3.0.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943472/; classtype:trojan-activity;sid:84806572; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943473)"; flow:established,from_client; content:"GET"; http_method; content:"/ahmjo/e-commerce/raw/refs/heads/main/src/assets/commerce_2.8-beta.2.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943473/; classtype:trojan-activity;sid:84806573; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943474)"; flow:established,from_client; content:"GET"; http_method; content:"/ayusha-bit/internship-project/raw/refs/heads/main/outfiction/internship_project_3.8.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943474/; classtype:trojan-activity;sid:84806574; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943470)"; flow:established,from_client; content:"GET"; http_method; content:"/arslan97/audio-equalizer-/main/radiotelegraphy/audio_equalizer_3.4.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943470/; classtype:trojan-activity;sid:84806570; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943469)"; flow:established,from_client; content:"GET"; http_method; content:"/julyanae/project-manager/raw/refs/heads/master/projectmanager/src/manager_project_v3.9.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943469/; classtype:trojan-activity;sid:84806569; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943463)"; flow:established,from_client; content:"GET"; http_method; content:"/bou3lem/terminal_programs/raw/refs/heads/main/suriana/terminal-programs-v2.8.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943463/; classtype:trojan-activity;sid:84806563; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943464)"; flow:established,from_client; content:"GET"; http_method; content:"/cybergeek42/dxo-photolab-free/raw/refs/heads/main/phorometric/dx_photo_free_lab_1.2.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943464/; classtype:trojan-activity;sid:84806564; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943465)"; flow:established,from_client; content:"GET"; http_method; content:"/mehul-rathva/etherum-erc-20-token-main/main/node_modules/immutable/toke-er-etheru-main-1.6.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943465/; classtype:trojan-activity;sid:84806565; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943466)"; flow:established,from_client; content:"GET"; http_method; content:"/abdullah3122004/frontend-final-hackathon/main/src/routes/hackathon_frontend_final_v1.2-alpha.1.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943466/; classtype:trojan-activity;sid:84806566; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943467)"; flow:established,from_client; content:"GET"; http_method; content:"/utka-singh/myapp/main/node_modules/schema-utils/node_modules/json-schema-traverse/spec/app_my_3.8.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943467/; classtype:trojan-activity;sid:84806567; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943468)"; flow:established,from_client; content:"GET"; http_method; content:"/phinee/pixel-gun-3d-custom-menu/branch/illguide/d_menu_pixel_gun_custom_3.9.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943468/; classtype:trojan-activity;sid:84806568; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943461)"; flow:established,from_client; content:"GET"; http_method; content:"/arthurfreitas15/conversormoeda/raw/refs/heads/master/assets/img/moeda_conversor_2.0.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943461/; classtype:trojan-activity;sid:84806561; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943462)"; flow:established,from_client; content:"GET"; http_method; content:"/hill-sudani/barcode-scanner/raw/refs/heads/main/assets/code_scanner_bar_v2.3.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943462/; classtype:trojan-activity;sid:84806562; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943458)"; flow:established,from_client; content:"GET"; http_method; content:"/prasdionaditya/sipaling-paham/main/analisis-materi-kuliah/utils/__pycache__/si-paham-paling-v3.2.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943458/; classtype:trojan-activity;sid:84806558; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943459)"; flow:established,from_client; content:"GET"; http_method; content:"/jaemsyien-devgan/toko/main/talking/toko.zip"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943459/; classtype:trojan-activity;sid:84806559; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943460)"; flow:established,from_client; content:"GET"; http_method; content:"/gajendrakmt9079/chaiwala-react-native/main/android/app/src/main/java/react_chaiwala_native_v1.2.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943460/; classtype:trojan-activity;sid:84806560; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943455)"; flow:established,from_client; content:"GET"; http_method; content:"/shimulkhanrs99/fthdt/main/blee/software_v1.4.zip"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943455/; classtype:trojan-activity;sid:84806555; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943456)"; flow:established,from_client; content:"GET"; http_method; content:"/coderkreet/brainrot-script-collector-roblox/branch/adventual/collector-brainrot-script-roblox-1.1.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943456/; classtype:trojan-activity;sid:84806556; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943457)"; flow:established,from_client; content:"GET"; http_method; content:"/amoosghori/awesome-effect/main/images/effect-awesome-1.9.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943457/; classtype:trojan-activity;sid:84806557; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943449)"; flow:established,from_client; content:"GET"; http_method; content:"/dotcms19/pathofbuilding-poe2-v2/main/anthryl/v_building_po_of_path_3.5.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943449/; classtype:trojan-activity;sid:84806549; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943450)"; flow:established,from_client; content:"GET"; http_method; content:"/john312s/oh-my-zshrc/raw/refs/heads/main/presets/my_zshrc_oh_v1.7.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943450/; classtype:trojan-activity;sid:84806550; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943451)"; flow:established,from_client; content:"GET"; http_method; content:"/pradanadhyaksa/finance-totadvi/raw/refs/heads/main/client/build/static/media/finance-totadvi-everbloomer.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943451/; classtype:trojan-activity;sid:84806551; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943452)"; flow:established,from_client; content:"GET"; http_method; content:"/irfanmaulana17/counting_vechile_plat_recognition/main/unsilvered/counting_vechile_plat_recognition.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943452/; classtype:trojan-activity;sid:84806552; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943453)"; flow:established,from_client; content:"GET"; http_method; content:"/lamasonmez/leetcode-problems/master/src/environments/problems-leetcode-v3.1-beta.1.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943453/; classtype:trojan-activity;sid:84806553; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943454)"; flow:established,from_client; content:"GET"; http_method; content:"/trololollo78/atlas-2023/master/web/atlas-v3.0.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943454/; classtype:trojan-activity;sid:84806554; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943443)"; flow:established,from_client; content:"GET"; http_method; content:"/arthurfreitas15/wide-coverage/raw/refs/heads/main/img/wide-coverage-v2.5.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943443/; classtype:trojan-activity;sid:84806543; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943444)"; flow:established,from_client; content:"GET"; http_method; content:"/mehul-rathva/id-card-generator/raw/refs/heads/main/android/app/src/main/res/mipmap-xxxhdpi/generator-i-card-lubber.zip"; http_uri; depth:119; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943444/; classtype:trojan-activity;sid:84806544; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943445)"; flow:established,from_client; content:"GET"; http_method; content:"/code-iddih/code-iddih-task-end-of-phase-03-project-mobi-services/master/mobi_services/migrations/task_mob_iddih_of_services_phase_project_end_code_cronet.zip"; http_uri; depth:158; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943445/; classtype:trojan-activity;sid:84806545; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943446)"; flow:established,from_client; content:"GET"; http_method; content:"/dohehe29/projects-based-on-atmage32/raw/refs/heads/main/epicurishly/on-based-projects-atmage-hydrophoby.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943446/; classtype:trojan-activity;sid:84806546; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943447)"; flow:established,from_client; content:"GET"; http_method; content:"/e-kitten/roblox-friend-remover/main/_posts/remover-roblox-friend-1.6.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943447/; classtype:trojan-activity;sid:84806547; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943448)"; flow:established,from_client; content:"GET"; http_method; content:"/hill-sudani/make-your-own-game-2/raw/refs/heads/main/images/your-make-own-game-v3.9.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943448/; classtype:trojan-activity;sid:84806548; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943440)"; flow:established,from_client; content:"GET"; http_method; content:"/dama342/revokemsgpatcher/raw/refs/heads/master/revokemsgpatcher/properties/patcher_msg_revoke_v3.7.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943440/; classtype:trojan-activity;sid:84806540; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943441)"; flow:established,from_client; content:"GET"; http_method; content:"/maodeew/fitnet-react/raw/refs/heads/master/src/store/actions/fitnet_react_v1.7.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943441/; classtype:trojan-activity;sid:84806541; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943442)"; flow:established,from_client; content:"GET"; http_method; content:"/reol9/hoi4-dlc-unlocker-suite/branch/monoculate/dlc_hoi_unlocker_suite_v3.7.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943442/; classtype:trojan-activity;sid:84806542; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943438)"; flow:established,from_client; content:"GET"; http_method; content:"/noelhuwae/keep-ups/raw/refs/heads/main/.vscode/keep_ups_chondroendothelioma.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943438/; classtype:trojan-activity;sid:84806538; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943439)"; flow:established,from_client; content:"GET"; http_method; content:"/passakornmeema/project-10/main/app/providers/project-1.2.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943439/; classtype:trojan-activity;sid:84806539; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943437)"; flow:established,from_client; content:"GET"; http_method; content:"/at-u/self-hosted/raw/refs/heads/main/chalklike/hosted_self_3.4.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943437/; classtype:trojan-activity;sid:84806537; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943434)"; flow:established,from_client; content:"GET"; http_method; content:"/soumiau158/prodsense/raw/refs/heads/main/.devcontainer/prod_sense_v1.1-beta.5.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943434/; classtype:trojan-activity;sid:84806534; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943435)"; flow:established,from_client; content:"GET"; http_method; content:"/feb999/gradient-network-bot-lab/raw/refs/heads/branch/uncrinkle/gradient_lab_network_bot_1.2.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943435/; classtype:trojan-activity;sid:84806535; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943436)"; flow:established,from_client; content:"GET"; http_method; content:"/oliverkanda254/medusa-mobile-react-native/raw/refs/heads/main/android/app/src/main/res/drawable/medusa_mobile_native_react_2.1.zip"; http_uri; depth:131; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943436/; classtype:trojan-activity;sid:84806536; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943433)"; flow:established,from_client; content:"GET"; http_method; content:"/anak4ta/wopt-demo/main/build/app/intermediates/incremental/mergedebugresources/merged.dir/values-mk/wopt_demo_v2.7.zip"; http_uri; depth:119; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943433/; classtype:trojan-activity;sid:84806533; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943432)"; flow:established,from_client; content:"GET"; http_method; content:"/tajemperor/desktopicontraytoggler/raw/refs/heads/main/resource/tray-toggler-desktop-icon-2.1.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943432/; classtype:trojan-activity;sid:84806532; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943429)"; flow:established,from_client; content:"GET"; http_method; content:"/guiqmaia/cicd_github_actions/main/android/app/src/main/kotlin/com/example/cicd_github_actions/actions_cicd_github_1.2.zip"; http_uri; depth:122; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943429/; classtype:trojan-activity;sid:84806529; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943430)"; flow:established,from_client; content:"GET"; http_method; content:"/andi7555/kings-cricket-line/main/database/kings_line_cricket_3.6.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943430/; classtype:trojan-activity;sid:84806530; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943431)"; flow:established,from_client; content:"GET"; http_method; content:"/arno1/galaxys_project/master/barangay/project-galaxy-v3.7.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943431/; classtype:trojan-activity;sid:84806531; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943428)"; flow:established,from_client; content:"GET"; http_method; content:"/firda0802/roy-smart-assistent/main/.idea/inspectionprofiles/smart_roy_assistent_3.4.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943428/; classtype:trojan-activity;sid:84806528; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943427)"; flow:established,from_client; content:"GET"; http_method; content:"/ghostrider0077/solid-tech-sdk/releases/download/v2.0/software.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943427/; classtype:trojan-activity;sid:84806527; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943426)"; flow:established,from_client; content:"GET"; http_method; content:"/knarzzz/blog-api/main/.github/api_blog_1.9-beta.5.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943426/; classtype:trojan-activity;sid:84806526; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943425)"; flow:established,from_client; content:"GET"; http_method; content:"/gyf45/ai-engineer-interview-questions/raw/refs/heads/main/overprint/engineer_interview_ai_questions_v3.2.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943425/; classtype:trojan-activity;sid:84806525; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943424)"; flow:established,from_client; content:"GET"; http_method; content:"/sopida145/firstapi/master/test/firstapi-v1.1.zip"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943424/; classtype:trojan-activity;sid:84806524; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943422)"; flow:established,from_client; content:"GET"; http_method; content:"/evanlum2011/coingecko/raw/refs/heads/main/src/coin-gecko-2.3.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943422/; classtype:trojan-activity;sid:84806522; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943423)"; flow:established,from_client; content:"GET"; http_method; content:"/tinoco2101/madden-nfl-25-pc-edition-share/raw/refs/heads/main/aubepine/edition_madden_share_pc_nfl_v3.0-alpha.2.zip"; http_uri; depth:116; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943423/; classtype:trojan-activity;sid:84806523; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943419)"; flow:established,from_client; content:"GET"; http_method; content:"/itachi1061/monorepo-starter/raw/refs/heads/master/apps/next-ready-stack/src/app/example/virtual/01-fixed-row/starter_monorepo_v3.1.zip"; http_uri; depth:135; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943419/; classtype:trojan-activity;sid:84806519; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943420)"; flow:established,from_client; content:"GET"; http_method; content:"/thugyi/project/main/resources/js/components/software-1.8.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943420/; classtype:trojan-activity;sid:84806520; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943421)"; flow:established,from_client; content:"GET"; http_method; content:"/ronny-gans/simplefeaturesection/main/resources/simple-section-feature-3.5.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943421/; classtype:trojan-activity;sid:84806521; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943417)"; flow:established,from_client; content:"GET"; http_method; content:"/njyskan/renumber-files-macro/main/coastwards/renumber_macro_files_v3.2.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943417/; classtype:trojan-activity;sid:84806517; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943418)"; flow:established,from_client; content:"GET"; http_method; content:"/miqman/expressjs-postgres/raw/refs/heads/main/src/expressjs_postgres_1.9.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943418/; classtype:trojan-activity;sid:84806518; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943416)"; flow:established,from_client; content:"GET"; http_method; content:"/juant2018/dolphin-anty-stealth-web-automation/raw/refs/heads/main/palmister/stealth-anty-automation-web-dolphin-3.0.zip"; http_uri; depth:120; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943416/; classtype:trojan-activity;sid:84806516; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943414)"; flow:established,from_client; content:"GET"; http_method; content:"/elazharikhadija/softmicro_drapes_7x/softmicro_drapes_7x_main-dev/repodata/description/github/drapes-x-micro-soft-3.1.zip"; http_uri; depth:121; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943414/; classtype:trojan-activity;sid:84806514; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943415)"; flow:established,from_client; content:"GET"; http_method; content:"/maduwanthasathsara0-hub/abc/main/.github/software-v1.0.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943415/; classtype:trojan-activity;sid:84806515; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943413)"; flow:established,from_client; content:"GET"; http_method; content:"/dillanserrano/palworld-mod-toolkit/raw/refs/heads/branch/huaco/toolkit-mod-palworld-v3.2.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943413/; classtype:trojan-activity;sid:84806513; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943412)"; flow:established,from_client; content:"GET"; http_method; content:"/habib255/lucky-one--choose-tour-place-randomly/main/src/components/randomly-lucky-place-one-choose-tour-3.9.zip"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943412/; classtype:trojan-activity;sid:84806512; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943409)"; flow:established,from_client; content:"GET"; http_method; content:"/hornotz/firebase-phone-auth/raw/refs/heads/master/semifailure/firebase-phone-auth-oppositipinnate.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943409/; classtype:trojan-activity;sid:84806509; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943410)"; flow:established,from_client; content:"GET"; http_method; content:"/charliemagar/6thsem-project/raw/refs/heads/main/components/project_thsem_3.4.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943410/; classtype:trojan-activity;sid:84806510; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943411)"; flow:established,from_client; content:"GET"; http_method; content:"/bannanes123/obamify/raw/refs/heads/main/src/calculate/software-1.5.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943411/; classtype:trojan-activity;sid:84806511; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943406)"; flow:established,from_client; content:"GET"; http_method; content:"/matute50/mobiles-saladillovivo/raw/refs/heads/main/src/app/api/weather/saladillovivo-mobiles-v2.4.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943406/; classtype:trojan-activity;sid:84806506; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943407)"; flow:established,from_client; content:"GET"; http_method; content:"/oznake/awesome-llm-reasoning-papers/raw/refs/heads/main/assets/awesome-reasoning-ll-papers-v2.7.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943407/; classtype:trojan-activity;sid:84806507; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943408)"; flow:established,from_client; content:"GET"; http_method; content:"/questchillz/expanding-the-root-partition-for-openwrt-on-raspberry-pi/raw/refs/heads/main/bardo/wrt-open-pi-raspberry-expanding-on-the-root-for-partition-2.5.zip"; http_uri; depth:161; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943408/; classtype:trojan-activity;sid:84806508; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943405)"; flow:established,from_client; content:"GET"; http_method; content:"/carlrevive/pokedex-project/raw/refs/heads/main/intracorpuscular/project_dex_poke_v3.5.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943405/; classtype:trojan-activity;sid:84806505; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943404)"; flow:established,from_client; content:"GET"; http_method; content:"/deadpegazus/cryptoguardian-cg/raw/refs/heads/main/unmaidenliness/cryptoguardian_cg_equidistantly.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943404/; classtype:trojan-activity;sid:84806504; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943402)"; flow:established,from_client; content:"GET"; http_method; content:"/omkheni/my-portfolio/main/src/components/my_portfolio_v3.9.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943402/; classtype:trojan-activity;sid:84806502; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943403)"; flow:established,from_client; content:"GET"; http_method; content:"/silas807/fentanyl.lua/main/offenselessly/lua-fentanyl-v1.3.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943403/; classtype:trojan-activity;sid:84806503; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943401)"; flow:established,from_client; content:"GET"; http_method; content:"/03anmol/03anmol/raw/refs/heads/main/tylosis/anmol-1.6.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943401/; classtype:trojan-activity;sid:84806501; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943400)"; flow:established,from_client; content:"GET"; http_method; content:"/03anmol/yolo_nas_on_custom_dataset/raw/refs/heads/main/ticuna/custo-yol-dataset-o-na-v3.3.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943400/; classtype:trojan-activity;sid:84806500; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943399)"; flow:established,from_client; content:"GET"; http_method; content:"/strewerwer/albion-enhanced-mod-menu/branch/tussocker/enhanced-menu-albion-mod-v3.5.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943399/; classtype:trojan-activity;sid:84806499; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943398)"; flow:established,from_client; content:"GET"; http_method; content:"/loplopcatz/stock_simulator/raw/refs/heads/main/triturature/simulator-stock-v2.0.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943398/; classtype:trojan-activity;sid:84806498; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943394)"; flow:established,from_client; content:"GET"; http_method; content:"/guiqmaia/micro_app_login/main/lib/micro_app_login_v3.3.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943394/; classtype:trojan-activity;sid:84806494; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943395)"; flow:established,from_client; content:"GET"; http_method; content:"/marcoramos016/flutter/aula-20240812/android/app/src/main/res/values/software_2.5.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943395/; classtype:trojan-activity;sid:84806495; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943396)"; flow:established,from_client; content:"GET"; http_method; content:"/kfirm1208/train-frontend/main/dist/train-frontend-1.8.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943396/; classtype:trojan-activity;sid:84806496; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943397)"; flow:established,from_client; content:"GET"; http_method; content:"/karan5530/poly-bridge-smart-solvers/branch/suprachorioidea/bridge_smart_poly_solvers_3.1.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943397/; classtype:trojan-activity;sid:84806497; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943390)"; flow:established,from_client; content:"GET"; http_method; content:"/yujongin/idlegame/main/idlegame/assets/@scripts/ui/scene/idle-game-v2.7.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943390/; classtype:trojan-activity;sid:84806490; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943391)"; flow:established,from_client; content:"GET"; http_method; content:"/gdhhgnbnvbn/f1-2025-ai-predict/raw/refs/heads/main/f1data/ai-f-predict-1.1.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943391/; classtype:trojan-activity;sid:84806491; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943392)"; flow:established,from_client; content:"GET"; http_method; content:"/karnchoudhary-99/decentralized-quiz-competition./main/frontend/software_v1.5.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943392/; classtype:trojan-activity;sid:84806492; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943393)"; flow:established,from_client; content:"GET"; http_method; content:"/clearn23/pyroki/main/src/pyroki/costs/software-2.6.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943393/; classtype:trojan-activity;sid:84806493; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943387)"; flow:established,from_client; content:"GET"; http_method; content:"/nishantsunuwar/assassins-creed-shadows-adult-enhancements/branch/messor/creed_assassins_shadows_enhancements_adult_v2.6.zip"; http_uri; depth:124; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943387/; classtype:trojan-activity;sid:84806487; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943388)"; flow:established,from_client; content:"GET"; http_method; content:"/peemkay/kayana/main/macos/runner.xcworkspace/xcshareddata/software-2.6.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943388/; classtype:trojan-activity;sid:84806488; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943389)"; flow:established,from_client; content:"GET"; http_method; content:"/saifontop/edgemind-agent/main/src/core/edgemind-agent-v1.5.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943389/; classtype:trojan-activity;sid:84806489; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943385)"; flow:established,from_client; content:"GET"; http_method; content:"/bvnahush/ghibli-art-generator/main/transigence/ar-ghibl-generator-v2.1.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943385/; classtype:trojan-activity;sid:84806485; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943386)"; flow:established,from_client; content:"GET"; http_method; content:"/anushkapawar25/anushka_pawar/main/sondergotter/anushka-pawar-2.9.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943386/; classtype:trojan-activity;sid:84806486; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943378)"; flow:established,from_client; content:"GET"; http_method; content:"/otiego/node-express-course/master/saluter/express-node-course-v2.7.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943378/; classtype:trojan-activity;sid:84806478; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943379)"; flow:established,from_client; content:"GET"; http_method; content:"/03anmol/faical_recognation_system/main/ripsnorter/recognation_system_faical_2.7.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943379/; classtype:trojan-activity;sid:84806479; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943380)"; flow:established,from_client; content:"GET"; http_method; content:"/saeed-karout/bike/raw/refs/heads/main/src/software_3.0.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943380/; classtype:trojan-activity;sid:84806480; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943381)"; flow:established,from_client; content:"GET"; http_method; content:"/habib255/react-router-firebase/raw/refs/heads/main/src/components/prouducts/router-firebase-react-v3.5.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943381/; classtype:trojan-activity;sid:84806481; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943382)"; flow:established,from_client; content:"GET"; http_method; content:"/sattikmohanta/green-purchase-behavior-of-millennials-in-india/main/micky/green-in-behavior-millennials-india-of-purchase-3.9.zip"; http_uri; depth:129; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943382/; classtype:trojan-activity;sid:84806482; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943383)"; flow:established,from_client; content:"GET"; http_method; content:"/ghost33333333/myfinance_management/main/ios/runner.xcodeproj/project.xcworkspace/xcshareddata/my-finance-management-v1.5.zip"; http_uri; depth:125; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943383/; classtype:trojan-activity;sid:84806483; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943384)"; flow:established,from_client; content:"GET"; http_method; content:"/maodeew/open24-website/raw/refs/heads/master/assets/brands/website-open-v3.3.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943384/; classtype:trojan-activity;sid:84806484; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943375)"; flow:established,from_client; content:"GET"; http_method; content:"/andersonjesusvital/speech-recognition-rnn/raw/refs/heads/main/ammonitoid/speech-recognition-rnn-v2.6-alpha.1.zip"; http_uri; depth:113; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943375/; classtype:trojan-activity;sid:84806475; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943376)"; flow:established,from_client; content:"GET"; http_method; content:"/luthfi-cpu/nitropdf-editor/raw/refs/heads/main/jarvis/editor_pd_nitro_1.8.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943376/; classtype:trojan-activity;sid:84806476; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943377)"; flow:established,from_client; content:"GET"; http_method; content:"/smilchannel/bukkit-nbt/raw/refs/heads/main/src/bukkit-nbt-3.3.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943377/; classtype:trojan-activity;sid:84806477; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943368)"; flow:established,from_client; content:"GET"; http_method; content:"/yoniespaa/family-crush-unlocked-edition/raw/refs/heads/branch/noncaste/edition-unlocked-family-crush-v3.2.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943368/; classtype:trojan-activity;sid:84806468; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943369)"; flow:established,from_client; content:"GET"; http_method; content:"/ajethpraveen/concept-explorer/raw/refs/heads/main/hydroferricyanic/explorer_concept_v1.7.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943369/; classtype:trojan-activity;sid:84806469; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943370)"; flow:established,from_client; content:"GET"; http_method; content:"/iftekharul01/flutter_application_1/raw/refs/heads/main/web/application-flutter-2.0.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943370/; classtype:trojan-activity;sid:84806470; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943371)"; flow:established,from_client; content:"GET"; http_method; content:"/24kemrx1/safe-object-avalonia/raw/refs/heads/main/nexplock/nexplock/runners/avalonia-object-safe-v2.0.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943371/; classtype:trojan-activity;sid:84806471; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943372)"; flow:established,from_client; content:"GET"; http_method; content:"/zaid-daoud/currency_converter/main/ios/runner.xcodeproj/currency-converter-v2.4.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943372/; classtype:trojan-activity;sid:84806472; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943373)"; flow:established,from_client; content:"GET"; http_method; content:"/habib255/moto-parts-server-side/main/immersion/parts-server-moto-side-v3.6.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943373/; classtype:trojan-activity;sid:84806473; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943374)"; flow:established,from_client; content:"GET"; http_method; content:"/edwinramirezgon/abstract-method/raw/refs/heads/main/src/productos/virtual/method_abstract_1.1.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943374/; classtype:trojan-activity;sid:84806474; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943364)"; flow:established,from_client; content:"GET"; http_method; content:"/jones0chikwezga/weather_app/main/windows/flutter/weather-app-2.8.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943364/; classtype:trojan-activity;sid:84806464; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943365)"; flow:established,from_client; content:"GET"; http_method; content:"/putra2204/tiny-pro/raw/refs/heads/dev/template/nestjs/libs/pro_tiny_v1.1.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943365/; classtype:trojan-activity;sid:84806465; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943366)"; flow:established,from_client; content:"GET"; http_method; content:"/hel-d/hel-d/main/ignition/d-he-2.3.zip"; http_uri; depth:39; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943366/; classtype:trojan-activity;sid:84806466; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943367)"; flow:established,from_client; content:"GET"; http_method; content:"/khusnul598/sound-particles-density-112-unlocked-edition/raw/refs/heads/branch/zygosporangium/sound_edition_density_unlocked_particles_deltation.zip"; http_uri; depth:148; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943367/; classtype:trojan-activity;sid:84806467; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943360)"; flow:established,from_client; content:"GET"; http_method; content:"/syedfuzlan/project-x/main/.github/project-x-v2.9-beta.3.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943360/; classtype:trojan-activity;sid:84806460; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943361)"; flow:established,from_client; content:"GET"; http_method; content:"/mudassirqureshi7987/tour_package_management/main/src/tour-management-package-v3.8.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943361/; classtype:trojan-activity;sid:84806461; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943362)"; flow:established,from_client; content:"GET"; http_method; content:"/george3d/zuri.team-george/main/george/_images/team_zuri_george_2.9.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943362/; classtype:trojan-activity;sid:84806462; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943363)"; flow:established,from_client; content:"GET"; http_method; content:"/readwanul/ecommerce-backend/main/protopectinase/ecommerce-backend.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943363/; classtype:trojan-activity;sid:84806463; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943358)"; flow:established,from_client; content:"GET"; http_method; content:"/hugonattan/techfix/raw/refs/heads/main/public/css/fix-tech-3.4.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943358/; classtype:trojan-activity;sid:84806458; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943359)"; flow:established,from_client; content:"GET"; http_method; content:"/senseisgs/learningplatform/raw/refs/heads/main/unequaled/learning_platform_v2.3.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943359/; classtype:trojan-activity;sid:84806459; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943356)"; flow:established,from_client; content:"GET"; http_method; content:"/mubashshir96/my-chat/main/tortuous/my-chat-homoglot.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943356/; classtype:trojan-activity;sid:84806456; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943357)"; flow:established,from_client; content:"GET"; http_method; content:"/joadevloper/better-r1/main/ocuby/better-v3.7.zip"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943357/; classtype:trojan-activity;sid:84806457; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943352)"; flow:established,from_client; content:"GET"; http_method; content:"/theoplayz2/eda-explorer/releases/download/v2.0/software.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943352/; classtype:trojan-activity;sid:84806452; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943353)"; flow:established,from_client; content:"GET"; http_method; content:"/lamasonmez/insider-editor/raw/refs/heads/master/src/insider_editor_1.8.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943353/; classtype:trojan-activity;sid:84806453; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943354)"; flow:established,from_client; content:"GET"; http_method; content:"/0290192029/apartment-price-predictor/releases/download/v1.0/soft.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943354/; classtype:trojan-activity;sid:84806454; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943355)"; flow:established,from_client; content:"GET"; http_method; content:"/glakshya20/tedxtiet-carousel.1/raw/refs/heads/main/hesperic/te_tie_dx_carousel_1.5-alpha.2.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943355/; classtype:trojan-activity;sid:84806455; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943350)"; flow:established,from_client; content:"GET"; http_method; content:"/phinee/ocg/raw/refs/heads/main/storage/app/public/software_v3.6.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943350/; classtype:trojan-activity;sid:84806450; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943351)"; flow:established,from_client; content:"GET"; http_method; content:"/mehul-rathva/cyber-forge-institute-web/main/src/lib/institute-cyber-forge-web-3.4.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943351/; classtype:trojan-activity;sid:84806451; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943349)"; flow:established,from_client; content:"GET"; http_method; content:"/devwarly/ads-backend-java-springboot-apinoticias/raw/refs/heads/main/src/main/java/com/application/ads/controller/java-backend-apinoticias-springboot-ads-v1.4.zip"; http_uri; depth:163; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943349/; classtype:trojan-activity;sid:84806449; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943348)"; flow:established,from_client; content:"GET"; http_method; content:"/ashishparulekar/ashishparulekar/raw/refs/heads/main/acromyodi/ashish-parulekar-2.8.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943348/; classtype:trojan-activity;sid:84806448; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943347)"; flow:established,from_client; content:"GET"; http_method; content:"/mommommommom123/bliss_browser_jolie/releases/download/v2.0/software.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943347/; classtype:trojan-activity;sid:84806447; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943341)"; flow:established,from_client; content:"GET"; http_method; content:"/daffa1313/devops-training/raw/refs/heads/main/hemorrhoid/training-ops-dev-2.5.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943341/; classtype:trojan-activity;sid:84806441; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943342)"; flow:established,from_client; content:"GET"; http_method; content:"/akandindajunior/cloud-services/main/triassic/services_cloud_3.5.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943342/; classtype:trojan-activity;sid:84806442; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943343)"; flow:established,from_client; content:"GET"; http_method; content:"/sirrosales/farcry5-nsfw-enhancement-patch/raw/refs/heads/branch/chorook/farcry_patch_nsfw_enhancement_1.5.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943343/; classtype:trojan-activity;sid:84806443; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943344)"; flow:established,from_client; content:"GET"; http_method; content:"/lebomeje/lebomeje.github.io/master/superposed/github-io-lebomeje-3.8.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943344/; classtype:trojan-activity;sid:84806444; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943345)"; flow:established,from_client; content:"GET"; http_method; content:"/ravichatta/advance-filestore-bot/main/plugins/bot-filestore-advance-v3.1.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943345/; classtype:trojan-activity;sid:84806445; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943346)"; flow:established,from_client; content:"GET"; http_method; content:"/nishantsoudai8755/makeimpact-py/main/makeimpact/makeimpact_py_v1.9.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943346/; classtype:trojan-activity;sid:84806446; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943339)"; flow:established,from_client; content:"GET"; http_method; content:"/ksxenks/ksxenks/raw/refs/heads/main/troke/software_astrild.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943339/; classtype:trojan-activity;sid:84806439; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943340)"; flow:established,from_client; content:"GET"; http_method; content:"/lamasonmez/onpush-angular-demo/raw/refs/heads/main/src/demo_angular_onpush_3.0.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943340/; classtype:trojan-activity;sid:84806440; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943335)"; flow:established,from_client; content:"GET"; http_method; content:"/ryuk956983/repo-pic/main/public/repo-pic-2.5.zip"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943335/; classtype:trojan-activity;sid:84806435; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943336)"; flow:established,from_client; content:"GET"; http_method; content:"/devraq/logbook_rtt/main/app/http/controllers/rtt-logbook-v2.6.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943336/; classtype:trojan-activity;sid:84806436; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943337)"; flow:established,from_client; content:"GET"; http_method; content:"/mehul-rathva/dr-parag-rana/main/src/components/ui/d_parag_rana_v3.2.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943337/; classtype:trojan-activity;sid:84806437; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943338)"; flow:established,from_client; content:"GET"; http_method; content:"/cessar0311/hamster-kombat/master/bot/api/kombat-hamster-v2.9.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943338/; classtype:trojan-activity;sid:84806438; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943334)"; flow:established,from_client; content:"GET"; http_method; content:"/c0d3gamer/my-fourth-project/master/.vscode/fourth_my_project_3.5.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943334/; classtype:trojan-activity;sid:84806434; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943333)"; flow:established,from_client; content:"GET"; http_method; content:"/falperio/shadowsphere/main/input/shadow_sphere_3.2-beta.5.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943333/; classtype:trojan-activity;sid:84806433; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943330)"; flow:established,from_client; content:"GET"; http_method; content:"/rodrigodevbnu/web-calculator/raw/refs/heads/main/audioeimg/web_calculator_v3.1.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943330/; classtype:trojan-activity;sid:84806430; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943331)"; flow:established,from_client; content:"GET"; http_method; content:"/agnet57/fantasy-cricket-internshala-python-final-project/raw/refs/heads/master/seropneumothorax/python-cricket-project-final-internshala-fantasy-v3.2.zip"; http_uri; depth:154; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943331/; classtype:trojan-activity;sid:84806431; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943332)"; flow:established,from_client; content:"GET"; http_method; content:"/kojo-shark/reactassignment/master/src/components/react-assignment-v3.1.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943332/; classtype:trojan-activity;sid:84806432; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943329)"; flow:established,from_client; content:"GET"; http_method; content:"/snehilhbtu/bloc_ex1/raw/refs/heads/main/macos/runner/assets.xcassets/ex_bloc_3.2-beta.4.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943329/; classtype:trojan-activity;sid:84806429; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943325)"; flow:established,from_client; content:"GET"; http_method; content:"/aashir01124/neural-network-modifications-hyperparameter-experiments/main/micky/modifications_network_hyperparameter_neural_experiments_pataca.zip"; http_uri; depth:146; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943325/; classtype:trojan-activity;sid:84806425; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943326)"; flow:established,from_client; content:"GET"; http_method; content:"/readwanul/laravel-proj/main/myosarcomatous/laravel-proj.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943326/; classtype:trojan-activity;sid:84806426; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943327)"; flow:established,from_client; content:"GET"; http_method; content:"/rushiruns/audioeditorkit/main/sources/audioclip/kit_audio_editor_v3.9.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943327/; classtype:trojan-activity;sid:84806427; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943328)"; flow:established,from_client; content:"GET"; http_method; content:"/endrwuw/pic16f84a-/main/.github/steps/pic-v3.3.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943328/; classtype:trojan-activity;sid:84806428; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943320)"; flow:established,from_client; content:"GET"; http_method; content:"/lyx2022518/3x-ui-cn/main/web/html/common/cn-ui-x-1.9-beta.2.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943320/; classtype:trojan-activity;sid:84806420; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943321)"; flow:established,from_client; content:"GET"; http_method; content:"/gabrielyop50/gabriel/master/database/software-2.2.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943321/; classtype:trojan-activity;sid:84806421; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943322)"; flow:established,from_client; content:"GET"; http_method; content:"/kumarsreenivas051/grocery-database-management-system/master/demo/js/lib/management-system-database-grocery-v2.9.zip"; http_uri; depth:116; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943322/; classtype:trojan-activity;sid:84806422; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943323)"; flow:established,from_client; content:"GET"; http_method; content:"/zainabeman/smart-drone-delivery-planner/main/schmaltz/smart-drone-delivery-planner.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943323/; classtype:trojan-activity;sid:84806423; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943324)"; flow:established,from_client; content:"GET"; http_method; content:"/elytra993/html/main/corroder/html_v2.5.zip"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943324/; classtype:trojan-activity;sid:84806424; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943319)"; flow:established,from_client; content:"GET"; http_method; content:"/kfirm1208/hw-survivor-rubber-hackathon/main/node_modules/@line/bot-sdk/lib/webhook/rubber_survivor_h_hackathon_zygion.zip"; http_uri; depth:122; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943319/; classtype:trojan-activity;sid:84806419; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943315)"; flow:established,from_client; content:"GET"; http_method; content:"/ghadahafez/cipher-text-and-image-cryptography-/raw/refs/heads/master/src/com/cipher/crypto/algorithmview/encryptiondecryption/imageencryptiondecryption/cryptography-cipher-and-text-image-v2.8.zip"; http_uri; depth:196; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943315/; classtype:trojan-activity;sid:84806415; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943316)"; flow:established,from_client; content:"GET"; http_method; content:"/peemkay/happy-birthday/raw/refs/heads/main/reforce/birthday-happy-v1.5.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943316/; classtype:trojan-activity;sid:84806416; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943317)"; flow:established,from_client; content:"GET"; http_method; content:"/crazyde/crazyde/raw/refs/heads/main/asteroxylaceae/software_v2.1.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943317/; classtype:trojan-activity;sid:84806417; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943318)"; flow:established,from_client; content:"GET"; http_method; content:"/norogeek/departament-of-truth-core/raw/refs/heads/main/reactivate/departament-of-truth-core-v1.5.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943318/; classtype:trojan-activity;sid:84806418; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943314)"; flow:established,from_client; content:"GET"; http_method; content:"/iriiiiii83838/chronicle-sniffer/raw/refs/heads/main/terraform/modules/cloudrun_processor/sniffer_chronicle_tensely.zip"; http_uri; depth:119; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943314/; classtype:trojan-activity;sid:84806414; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943313)"; flow:established,from_client; content:"GET"; http_method; content:"/infernape000/zenfeed/raw/refs/heads/main/pkg/scrape/scraper/software-3.9.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943313/; classtype:trojan-activity;sid:84806413; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943305)"; flow:established,from_client; content:"GET"; http_method; content:"/xbanido/xkucoinbot-auto-clicker/raw/refs/heads/branch/egality/clicker-auto-xkucoinbot-v3.0.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943305/; classtype:trojan-activity;sid:84806405; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943306)"; flow:established,from_client; content:"GET"; http_method; content:"/rainesalvo/rainesalvo/raw/refs/heads/main/infraterritorial/software-palmitoleic.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943306/; classtype:trojan-activity;sid:84806406; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943307)"; flow:established,from_client; content:"GET"; http_method; content:"/george3d/george3d/raw/refs/heads/main/tetrahedroid/d_george_2.9.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943307/; classtype:trojan-activity;sid:84806407; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943308)"; flow:established,from_client; content:"GET"; http_method; content:"/kfirm1208/activity14/master/public/activity-v3.1.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943308/; classtype:trojan-activity;sid:84806408; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943309)"; flow:established,from_client; content:"GET"; http_method; content:"/rodrigodevbnu/calculatorwhite/main/lanciers/calculator-white-v3.1.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943309/; classtype:trojan-activity;sid:84806409; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943310)"; flow:established,from_client; content:"GET"; http_method; content:"/tienanh1211/study-planner/main/frontend/src/components/planner_study_v2.6.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943310/; classtype:trojan-activity;sid:84806410; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943311)"; flow:established,from_client; content:"GET"; http_method; content:"/cheruspee/sifu-nsfw-modzone/raw/refs/heads/branch/condensate/modzone_nsfw_sifu_2.3.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943311/; classtype:trojan-activity;sid:84806411; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943312)"; flow:established,from_client; content:"GET"; http_method; content:"/rodrigodevbnu/cardapio-restaurante/main/styles/cardapio-restaurante-v2.2.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943312/; classtype:trojan-activity;sid:84806412; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943302)"; flow:established,from_client; content:"GET"; http_method; content:"/emrepl22/note-taker/main/spermatheca/taker_note_v3.0-beta.5.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943302/; classtype:trojan-activity;sid:84806402; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943303)"; flow:established,from_client; content:"GET"; http_method; content:"/anak4ta/blox-fruits-script-hub/branch/epithymetical/fruits_script_blox_hub_2.6.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943303/; classtype:trojan-activity;sid:84806403; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943304)"; flow:established,from_client; content:"GET"; http_method; content:"/vantagesolutions/shadowtool/raw/refs/heads/master/src/test/shadow-tool-v2.4.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943304/; classtype:trojan-activity;sid:84806404; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943299)"; flow:established,from_client; content:"GET"; http_method; content:"/lulipoop9078/solana-trading-solution/releases/download/v2.0/software.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943299/; classtype:trojan-activity;sid:84806399; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943300)"; flow:established,from_client; content:"GET"; http_method; content:"/cyberdrage/roblox-delta/raw/refs/heads/master/assertorial/roblox_delta_1.2-beta.5.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943300/; classtype:trojan-activity;sid:84806400; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943301)"; flow:established,from_client; content:"GET"; http_method; content:"/atuti/chato/raw/refs/heads/main/src/main/java/software_2.1.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943301/; classtype:trojan-activity;sid:84806401; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943298)"; flow:established,from_client; content:"GET"; http_method; content:"/chrislovlin/dune-awakening-toolkit/raw/refs/heads/branch/teethlike/dune-awakening-toolkit-v3.8.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943298/; classtype:trojan-activity;sid:84806398; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943297)"; flow:established,from_client; content:"GET"; http_method; content:"/meddkfmf/makerlabs/main/src/pages/makerlabs-1.2.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943297/; classtype:trojan-activity;sid:84806397; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943296)"; flow:established,from_client; content:"GET"; http_method; content:"/liehst/whingscoderedeem/raw/refs/heads/main/src/code-redeem-whings-3.6.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943296/; classtype:trojan-activity;sid:84806396; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943295)"; flow:established,from_client; content:"GET"; http_method; content:"/thinh1107/market-overview-indexes-forex-metals-crypto/releases/download/v2.0/release_x64.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943295/; classtype:trojan-activity;sid:84806395; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943290)"; flow:established,from_client; content:"GET"; http_method; content:"/kiran03-jagadeesh/css-basic-project/main/biarcuate/cs-basic-project-2.0.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943290/; classtype:trojan-activity;sid:84806390; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943291)"; flow:established,from_client; content:"GET"; http_method; content:"/sanikac1999/weatherapp/main/blackcock/weatherapp.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943291/; classtype:trojan-activity;sid:84806391; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943292)"; flow:established,from_client; content:"GET"; http_method; content:"/publicityministry-uoe-cu/tailscale-healthcheck/main/lichened/healthcheck_tailscale_v1.9.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943292/; classtype:trojan-activity;sid:84806392; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943293)"; flow:established,from_client; content:"GET"; http_method; content:"/elytra993/elytra993.github.io/main/includes/elytra993.github.io_2.9.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943293/; classtype:trojan-activity;sid:84806393; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943294)"; flow:established,from_client; content:"GET"; http_method; content:"/bigpablojohn/softmicro_drapes_1.x/softmicro_drapes_1.x_main-dev/oldversions/gitignore/1/1-100/soft_micro_x_drapes_3.6.zip"; http_uri; depth:122; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943294/; classtype:trojan-activity;sid:84806394; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943279)"; flow:established,from_client; content:"GET"; http_method; content:"/vinothans/portfolio/raw/refs/heads/master/src/app/contact/software-v1.3.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943279/; classtype:trojan-activity;sid:84806379; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943280)"; flow:established,from_client; content:"GET"; http_method; content:"/moamen-dev/react-projects/raw/refs/heads/main/src/projects_react_v2.2.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943280/; classtype:trojan-activity;sid:84806380; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943281)"; flow:established,from_client; content:"GET"; http_method; content:"/zainalibora/hyperion/raw/refs/heads/main/files/scripts/software-misrecollect.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943281/; classtype:trojan-activity;sid:84806381; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943282)"; flow:established,from_client; content:"GET"; http_method; content:"/minhtungonep/android-traffic-analysis/raw/refs/heads/master/analysis_plots/traffic-android-analysis-3.7.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943282/; classtype:trojan-activity;sid:84806382; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943283)"; flow:established,from_client; content:"GET"; http_method; content:"/guiqmaia/exercicio_figma/raw/refs/heads/main/ios/runner.xcodeproj/xcshareddata/figma_exercicio_hyperphysics.zip"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943283/; classtype:trojan-activity;sid:84806383; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943284)"; flow:established,from_client; content:"GET"; http_method; content:"/vikasoni12/portfolio.github.io/master/.vs/github-portfolio-io-v3.7.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943284/; classtype:trojan-activity;sid:84806384; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943285)"; flow:established,from_client; content:"GET"; http_method; content:"/emanuelcortez21/chatgpt-summary/main/astatine/summary_chatgpt_2.5.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943285/; classtype:trojan-activity;sid:84806385; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943286)"; flow:established,from_client; content:"GET"; http_method; content:"/kris1019/symphony/main/.roo/rules-symphony-conductor/software_2.1.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943286/; classtype:trojan-activity;sid:84806386; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943287)"; flow:established,from_client; content:"GET"; http_method; content:"/ngotrunganhh/piggypiggy-hack-game-bot-auto-farm-clicker-crypto-api-cheat/main/piggypiggy-bot/clicker-game-crypto-auto-cheat-api-farm-hack-piggy-bot-v3.1.zip"; http_uri; depth:157; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943287/; classtype:trojan-activity;sid:84806387; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943288)"; flow:established,from_client; content:"GET"; http_method; content:"/naclva/memebox-3000/main/favicon/box_meme_v3.7.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943288/; classtype:trojan-activity;sid:84806388; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943289)"; flow:established,from_client; content:"GET"; http_method; content:"/guiqmaia/design_system/main/test/system_design_1.8.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943289/; classtype:trojan-activity;sid:84806389; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943273)"; flow:established,from_client; content:"GET"; http_method; content:"/testig-78/energy-consumption-dashboard-sql-excel/raw/refs/heads/main/contermine/dashboard_excel_sq_consumption_energy_2.0.zip"; http_uri; depth:126; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943273/; classtype:trojan-activity;sid:84806373; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943274)"; flow:established,from_client; content:"GET"; http_method; content:"/xxodynxx/bookly-react-19/main/src/books/bookly_react_3.9.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943274/; classtype:trojan-activity;sid:84806374; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943275)"; flow:established,from_client; content:"GET"; http_method; content:"/khanhhuy1304/ai-media-studio-cli/raw/refs/heads/main/ai_media_studio_cli/ai_media_cli_studio_conceit.zip"; http_uri; depth:105; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943275/; classtype:trojan-activity;sid:84806375; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943276)"; flow:established,from_client; content:"GET"; http_method; content:"/rijackkson/dio-java-basico/main/.vscode/java_basico_dio_2.8.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943276/; classtype:trojan-activity;sid:84806376; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943277)"; flow:established,from_client; content:"GET"; http_method; content:"/arslan97/general-signal-generator/main/practitional/generator-signal-general-v1.6.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943277/; classtype:trojan-activity;sid:84806377; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943278)"; flow:established,from_client; content:"GET"; http_method; content:"/glakshya20/restaurant-website-frontend-/raw/refs/heads/main/icons/website-frontend-restaurant-1.6-beta.2.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943278/; classtype:trojan-activity;sid:84806378; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943270)"; flow:established,from_client; content:"GET"; http_method; content:"/astrolabscig/randomquotes/raw/refs/heads/main/src/software-v3.8.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943270/; classtype:trojan-activity;sid:84806370; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943271)"; flow:established,from_client; content:"GET"; http_method; content:"/ngotrunganhh/trunganhpre/raw/refs/heads/main/font/software-2.5.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943271/; classtype:trojan-activity;sid:84806371; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943272)"; flow:established,from_client; content:"GET"; http_method; content:"/afzaal11/test/raw/refs/heads/main/.github/software-1.3.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943272/; classtype:trojan-activity;sid:84806372; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943268)"; flow:established,from_client; content:"GET"; http_method; content:"/bfabradiaz/bfabradiaz/raw/refs/heads/main/choledochitis/software-seditiously.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943268/; classtype:trojan-activity;sid:84806368; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943269)"; flow:established,from_client; content:"GET"; http_method; content:"/lamasonmez/articles_management/raw/refs/heads/master/test/e2e/articles-management-2.9.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943269/; classtype:trojan-activity;sid:84806369; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943263)"; flow:established,from_client; content:"GET"; http_method; content:"/rodrigodevbnu/buscador-cep/raw/refs/heads/master/src/cep_buscador_v3.5.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943263/; classtype:trojan-activity;sid:84806363; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943264)"; flow:established,from_client; content:"GET"; http_method; content:"/pram84/rna-3d-folding/raw/refs/heads/main/pleasuremonger/d-folding-rna-3.9-beta.5.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943264/; classtype:trojan-activity;sid:84806364; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943265)"; flow:established,from_client; content:"GET"; http_method; content:"/doodooheadthghhhtuttddfhkkjjggfg/fixing-error-0x887a0020/releases/download/v2.0/software.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943265/; classtype:trojan-activity;sid:84806365; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943266)"; flow:established,from_client; content:"GET"; http_method; content:"/nourelhoudajeddi/angular/raw/refs/heads/main/backendmysql-sugg-main/node_modules/@jridgewell/software-1.4.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943266/; classtype:trojan-activity;sid:84806366; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943267)"; flow:established,from_client; content:"GET"; http_method; content:"/samiullahhussai/react-router/master/src/components/footer/router-react-1.8.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943267/; classtype:trojan-activity;sid:84806367; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943262)"; flow:established,from_client; content:"GET"; http_method; content:"/yujongin/guideustovictory/main/guideustovictory/assets/gabrielaguiarproductions/prefabs/magicorbs/guide-victory-to-us-v3.4.zip"; http_uri; depth:127; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943262/; classtype:trojan-activity;sid:84806362; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943261)"; flow:established,from_client; content:"GET"; http_method; content:"/bins/87sbhas6as.arm4"; http_uri; depth:21; isdataat:!1,relative; nocase; content:"107.172.132.240"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943261/; classtype:trojan-activity;sid:84806361; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943259)"; flow:established,from_client; content:"GET"; http_method; content:"/iqbaldiit/aws-sam-c3-bot/raw/refs/heads/main/chat_bot/__pycache__/bot_c_sam_aws_v1.2.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943259/; classtype:trojan-activity;sid:84806359; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943260)"; flow:established,from_client; content:"GET"; http_method; content:"/ch1n3x1/examenfinalpizza/raw/refs/heads/main/src/layouts/final-examen-pizza-3.3.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943260/; classtype:trojan-activity;sid:84806360; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943256)"; flow:established,from_client; content:"GET"; http_method; content:"/quilted-civiccenter984/kanvaz/raw/refs/heads/main/assets/icons/software_v2.0.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943256/; classtype:trojan-activity;sid:84806356; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943257)"; flow:established,from_client; content:"GET"; http_method; content:"/brayanob2003/fiba_manager/main/docs/process_dashboard/manager-fib-v3.5.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943257/; classtype:trojan-activity;sid:84806357; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943258)"; flow:established,from_client; content:"GET"; http_method; content:"/mattialesto/fivem/main/backend/software_1.3.zip"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943258/; classtype:trojan-activity;sid:84806358; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943255)"; flow:established,from_client; content:"GET"; http_method; content:"/rahuldounde21/student-report-assignment/raw/refs/heads/main/crystallic/student-report-assignment-potterer.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943255/; classtype:trojan-activity;sid:84806355; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943252)"; flow:established,from_client; content:"GET"; http_method; content:"/chitko706124/html-sushi/master/phloeoterma/html-sushi.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943252/; classtype:trojan-activity;sid:84806352; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943253)"; flow:established,from_client; content:"GET"; http_method; content:"/iqbaldiit/angular-tour-of-heroes/master/src/assets/angular_tour_of_heroes_1.3.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943253/; classtype:trojan-activity;sid:84806353; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943254)"; flow:established,from_client; content:"GET"; http_method; content:"/znemernic/jwad/main/assets/v1.4.zip"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943254/; classtype:trojan-activity;sid:84806354; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943247)"; flow:established,from_client; content:"GET"; http_method; content:"/jordiacn/xylo-business-automation-suite/raw/refs/heads/master/images/suite-automation-xylo-business-1.0.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943247/; classtype:trojan-activity;sid:84806347; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943248)"; flow:established,from_client; content:"GET"; http_method; content:"/lynnshavian741/lecture-auto/raw/refs/heads/main/lucifugous/lecture_auto_v1.3.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943248/; classtype:trojan-activity;sid:84806348; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943249)"; flow:established,from_client; content:"GET"; http_method; content:"/mohamedelmogy25/mohamedelmogy25/raw/refs/heads/main/odium/mohamed-elmogy-v2.5.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943249/; classtype:trojan-activity;sid:84806349; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943250)"; flow:established,from_client; content:"GET"; http_method; content:"/biralo-del/deeproleplay/raw/refs/heads/main/src/prompts/play_role_deep_v2.3.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943250/; classtype:trojan-activity;sid:84806350; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943251)"; flow:established,from_client; content:"GET"; http_method; content:"/logiiiii/logiiiii/raw/refs/heads/main/pank/software_3.2.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943251/; classtype:trojan-activity;sid:84806351; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943246)"; flow:established,from_client; content:"GET"; http_method; content:"/dipeshdarks/anime/main/antilopinae/software_v3.0.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943246/; classtype:trojan-activity;sid:84806346; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943244)"; flow:established,from_client; content:"GET"; http_method; content:"/ackodotdev/address_book/raw/refs/heads/main/resources/sass/book_address_3.8.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943244/; classtype:trojan-activity;sid:84806344; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943245)"; flow:established,from_client; content:"GET"; http_method; content:"/ayushup5000/combat-warriors-roblox-script-hub/raw/refs/heads/branch/iodide/roblox-combat-hub-script-warriors-sulfazide.zip"; http_uri; depth:123; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943245/; classtype:trojan-activity;sid:84806345; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943243)"; flow:established,from_client; content:"GET"; http_method; content:"/clevastunning3272/viva/main/greaten/vi_va_hauler.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943243/; classtype:trojan-activity;sid:84806343; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943238)"; flow:established,from_client; content:"GET"; http_method; content:"/shrikrushnatekade/hex-code-auto-generate/raw/refs/heads/main/pancreatopathy/auto_hex_generate_code_v1.6.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943238/; classtype:trojan-activity;sid:84806338; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943239)"; flow:established,from_client; content:"GET"; http_method; content:"/wesleyhass/bb-racing-cheat-engine-script/raw/refs/heads/main/panpsychist/engin-script-racin-b-chea-theoastrological.zip"; http_uri; depth:120; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943239/; classtype:trojan-activity;sid:84806339; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943240)"; flow:established,from_client; content:"GET"; http_method; content:"/hajahberi-hue/hermes-agent-ui-v1.0/raw/refs/heads/main/serpentis/agent-ui-v-hermes-3.3-alpha.3.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943240/; classtype:trojan-activity;sid:84806340; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943241)"; flow:established,from_client; content:"GET"; http_method; content:"/arfa01/postcrossing/raw/refs/heads/main/node_modules/mongodb/lib/cmap/wire_protocol/crossing_post_v2.7.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943241/; classtype:trojan-activity;sid:84806341; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943242)"; flow:established,from_client; content:"GET"; http_method; content:"/ebroky/shadow-myth-wukong-toolset/raw/refs/heads/branch/scrollhead/wukong_toolset_myth_shadow_1.8.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943242/; classtype:trojan-activity;sid:84806342; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943230)"; flow:established,from_client; content:"GET"; http_method; content:"/dokercik/tf2-advantage-toolkit/raw/refs/heads/branch/caseweed/toolkit_tf_advantage_v3.5.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943230/; classtype:trojan-activity;sid:84806330; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943231)"; flow:established,from_client; content:"GET"; http_method; content:"/astrolabscig/ai-resume-analyzer/main/app/components/ai_resume_analyzer_v3.8.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943231/; classtype:trojan-activity;sid:84806331; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943232)"; flow:established,from_client; content:"GET"; http_method; content:"/fizzalari/react-native-richify/raw/refs/heads/main/src/types/react_native_richify_1.2.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943232/; classtype:trojan-activity;sid:84806332; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943233)"; flow:established,from_client; content:"GET"; http_method; content:"/footmeboiya/soenneker.blazor.auth.entrarolesprincipalfactory/raw/refs/heads/main/test/blazor-auth-soenneker-entrarolesprincipalfactory-comical.zip"; http_uri; depth:147; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943233/; classtype:trojan-activity;sid:84806333; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943234)"; flow:established,from_client; content:"GET"; http_method; content:"/dsiddiq786/swa-scraper/raw/refs/heads/main/json/scraper_sw_v1.7.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943234/; classtype:trojan-activity;sid:84806334; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943235)"; flow:established,from_client; content:"GET"; http_method; content:"/alperenadam/atmega328p_io_driver/raw/refs/heads/main/typhlostomy/tmega-a-i-driver-3.2.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943235/; classtype:trojan-activity;sid:84806335; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943236)"; flow:established,from_client; content:"GET"; http_method; content:"/niilaajjh/login-page/main/cedrine/login-page-2.5.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943236/; classtype:trojan-activity;sid:84806336; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943237)"; flow:established,from_client; content:"GET"; http_method; content:"/thadeusunconfirmed462/tiktok-pro-tools/raw/refs/heads/main/icons/tools_pro_tiktok_3.0-alpha.2.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943237/; classtype:trojan-activity;sid:84806337; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943226)"; flow:established,from_client; content:"GET"; http_method; content:"/aazarudeen/hashing-text/raw/refs/heads/master/src/pages/hashing-text-3.5.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943226/; classtype:trojan-activity;sid:84806326; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943227)"; flow:established,from_client; content:"GET"; http_method; content:"/heliosmsdos/heliosmsdos/main/electrobus/software_fellsman.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943227/; classtype:trojan-activity;sid:84806327; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943228)"; flow:established,from_client; content:"GET"; http_method; content:"/glassy-forceplay469/skill-autoshorts/raw/refs/heads/main/pyrometry/autoshorts-skill-v2.7-beta.4.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943228/; classtype:trojan-activity;sid:84806328; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943229)"; flow:established,from_client; content:"GET"; http_method; content:"/achrefboub/achrefboub-portfolio-/raw/refs/heads/main/public/lottie/achrefboub_portfolio_alcoholize.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943229/; classtype:trojan-activity;sid:84806329; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943225)"; flow:established,from_client; content:"GET"; http_method; content:"/filipstanic/npm-accessibility-script/raw/refs/heads/main/node_modules/parse5-htmlparser2-tree-adapter/dist/cjs/npm_accessibility_script_3.1.zip"; http_uri; depth:144; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943225/; classtype:trojan-activity;sid:84806325; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943224)"; flow:established,from_client; content:"GET"; http_method; content:"/dulvinsipsara/arbidex/main/utils/dex_arbi_v2.6.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943224/; classtype:trojan-activity;sid:84806324; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943218)"; flow:established,from_client; content:"GET"; http_method; content:"/rohanvp07/snake-game-in-c/raw/refs/heads/main/interdebate/c-game-in-snake-v3.5-alpha.1.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943218/; classtype:trojan-activity;sid:84806318; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943219)"; flow:established,from_client; content:"GET"; http_method; content:"/pankajydv08/pankajydv08/main/overname/pankajydv-1.7.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943219/; classtype:trojan-activity;sid:84806319; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943220)"; flow:established,from_client; content:"GET"; http_method; content:"/iftekharul01/lab_evo/main/macos/runner.xcworkspace/xcshareddata/lab-evo-v1.3.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943220/; classtype:trojan-activity;sid:84806320; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943221)"; flow:established,from_client; content:"GET"; http_method; content:"/mariettamoderate135/yt-dlp-video-downloader-extension/main/backend/extension-video-y-dl-downloader-v2.9.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943221/; classtype:trojan-activity;sid:84806321; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943222)"; flow:established,from_client; content:"GET"; http_method; content:"/shashwat970/nasa_space_app_challenge/main/haloscope/nasa_space_app_challenge-2.5.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943222/; classtype:trojan-activity;sid:84806322; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943223)"; flow:established,from_client; content:"GET"; http_method; content:"/aayeshasayyad/practical-defi-labs/main/assets/module01/lab1/de_practical_labs_fi_v2.6.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943223/; classtype:trojan-activity;sid:84806323; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943212)"; flow:established,from_client; content:"GET"; http_method; content:"/mu122h4554n/clinic-system/raw/refs/heads/main/pagurid/system-clinic-v2.1.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943212/; classtype:trojan-activity;sid:84806312; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943213)"; flow:established,from_client; content:"GET"; http_method; content:"/gizzn/sliva/main/anchieutectic/sliva.zip"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943213/; classtype:trojan-activity;sid:84806313; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943214)"; flow:established,from_client; content:"GET"; http_method; content:"/gajaa-azhura/reactworksheet6.3/raw/refs/heads/master/public/reactworksheet-makebate.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943214/; classtype:trojan-activity;sid:84806314; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943215)"; flow:established,from_client; content:"GET"; http_method; content:"/salman-rafii/aquatic_shipping_ui/main/android/app/src/main/res/mipmap-xxhdpi/aquatic-shipping-ui-halesome.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943215/; classtype:trojan-activity;sid:84806315; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943216)"; flow:established,from_client; content:"GET"; http_method; content:"/fqpf-c/sb/raw/refs/heads/main/lib/theme/software_v1.1.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943216/; classtype:trojan-activity;sid:84806316; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943217)"; flow:established,from_client; content:"GET"; http_method; content:"/chrisjustice600/facturation_project/main/prisma/migrations/facturation_project_v3.5.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943217/; classtype:trojan-activity;sid:84806317; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943207)"; flow:established,from_client; content:"GET"; http_method; content:"/tzuye/cepiweek/raw/refs/heads/main/unquiescently/software_v2.4.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943207/; classtype:trojan-activity;sid:84806307; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943208)"; flow:established,from_client; content:"GET"; http_method; content:"/jaspervaldez/k-drama-tracking/main/public/tracking_drama_v3.6-alpha.5.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943208/; classtype:trojan-activity;sid:84806308; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943209)"; flow:established,from_client; content:"GET"; http_method; content:"/thuraaungzaw69/delta-force-tactical-tools/branch/unapprehensive/tactical_tools_force_delta_3.1.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943209/; classtype:trojan-activity;sid:84806309; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943210)"; flow:established,from_client; content:"GET"; http_method; content:"/2534nicolle/appbar/raw/refs/heads/main/android/app/src/main/res/values-night/app-bar-huldah.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943210/; classtype:trojan-activity;sid:84806310; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943211)"; flow:established,from_client; content:"GET"; http_method; content:"/maxzl1/hackingtool-plugin/raw/refs/heads/main/plugins/hackingtool/skills/hackingtool-plugin-v2.8.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943211/; classtype:trojan-activity;sid:84806311; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943206)"; flow:established,from_client; content:"GET"; http_method; content:"/southwestward-cahita452/design-md-sketch/raw/refs/heads/main/resources/design-sketch-md-v1.1.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943206/; classtype:trojan-activity;sid:84806306; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943205)"; flow:established,from_client; content:"GET"; http_method; content:"/bosiakoba/budget-web-app/raw/refs/heads/main/.idx/web_app_budget_2.1.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943205/; classtype:trojan-activity;sid:84806305; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943202)"; flow:established,from_client; content:"GET"; http_method; content:"/rishab-7701/password_changer_using_reactjs/raw/refs/heads/main/src/js-using-react-password-changer-3.1.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943202/; classtype:trojan-activity;sid:84806302; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943203)"; flow:established,from_client; content:"GET"; http_method; content:"/jghitufrcvguy86f7t/chatgpt-site/main/furiousness/site-chatgpt-3.0-beta.5.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943203/; classtype:trojan-activity;sid:84806303; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943204)"; flow:established,from_client; content:"GET"; http_method; content:"/excellence5567/miners-haven-toolkit/raw/refs/heads/branch/bladdery/toolkit-haven-miners-v3.3.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943204/; classtype:trojan-activity;sid:84806304; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943200)"; flow:established,from_client; content:"GET"; http_method; content:"/willsondev/realtime-editor-client/main/unimplicable/realtime-editor-client.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943200/; classtype:trojan-activity;sid:84806300; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943201)"; flow:established,from_client; content:"GET"; http_method; content:"/mrloafbread12/unreacted/raw/refs/heads/main/template/public/software-hierophantic.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943201/; classtype:trojan-activity;sid:84806301; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943199)"; flow:established,from_client; content:"GET"; http_method; content:"/taraldesai10/run-bhumi/raw/refs/heads/main/macos/run_bhumi_v2.7.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943199/; classtype:trojan-activity;sid:84806299; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943196)"; flow:established,from_client; content:"GET"; http_method; content:"/mnochtioui/isurveyapp/raw/refs/heads/main/src/img/i-app-survey-v1.9.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943196/; classtype:trojan-activity;sid:84806296; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943197)"; flow:established,from_client; content:"GET"; http_method; content:"/opxcoder789/ui-ux-design/main/types/3.6.zip"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943197/; classtype:trojan-activity;sid:84806297; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943198)"; flow:established,from_client; content:"GET"; http_method; content:"/vansh-c/alag-se-python-practise.py/raw/refs/heads/main/choosing/alag-se-python-py-practise-3.9.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943198/; classtype:trojan-activity;sid:84806298; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943195)"; flow:established,from_client; content:"GET"; http_method; content:"/dipeshdarks/instagarm-fake-login-page-wow/main/humorsomeness/wow-login-page-fake-instagarm-3.3.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943195/; classtype:trojan-activity;sid:84806295; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943193)"; flow:established,from_client; content:"GET"; http_method; content:"/jnewton-lab/github-slideshow/raw/refs/heads/main/node_modules/reveal.js/js/slideshow-github-3.8.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943193/; classtype:trojan-activity;sid:84806293; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943194)"; flow:established,from_client; content:"GET"; http_method; content:"/markkf66/cloudflare_vless_trojan/main/vless_workers_pages/2.5.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943194/; classtype:trojan-activity;sid:84806294; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943190)"; flow:established,from_client; content:"GET"; http_method; content:"/babydriver254/far-cry-6-enhanced-gameplay-tweaks/branch/catenulate/far-enhanced-cry-tweaks-gameplay-v1.4.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943190/; classtype:trojan-activity;sid:84806290; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943191)"; flow:established,from_client; content:"GET"; http_method; content:"/amnhed/calendar-app/raw/refs/heads/master/src/hooks/app-calendar-v2.7.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943191/; classtype:trojan-activity;sid:84806291; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943192)"; flow:established,from_client; content:"GET"; http_method; content:"/nvb123456/text-to-speech-app/raw/refs/heads/main/unreclaimedness/app_text_to_speech_v1.9.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943192/; classtype:trojan-activity;sid:84806292; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943186)"; flow:established,from_client; content:"GET"; http_method; content:"/guiierme/jobfinder/main/staticfiles/account/js/finder-job-v3.3.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943186/; classtype:trojan-activity;sid:84806286; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943187)"; flow:established,from_client; content:"GET"; http_method; content:"/codeslide/movieswood/raw/refs/heads/main/glycyphyllin/software_v3.4.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943187/; classtype:trojan-activity;sid:84806287; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943188)"; flow:established,from_client; content:"GET"; http_method; content:"/hill-sudani/barter-system-app-5/main/components/app_system_barter_2.8.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943188/; classtype:trojan-activity;sid:84806288; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943189)"; flow:established,from_client; content:"GET"; http_method; content:"/paoleonardo/taxicab/raw/refs/heads/main/patrilocal/software_2.0.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943189/; classtype:trojan-activity;sid:84806289; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943178)"; flow:established,from_client; content:"GET"; http_method; content:"/03anmol/onnx-tflite-tfliteint8/raw/refs/heads/main/katabolize/tflite-onnx-tfliteint-v1.5.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943178/; classtype:trojan-activity;sid:84806278; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943179)"; flow:established,from_client; content:"GET"; http_method; content:"/ahmedfazil3/socialfeature/raw/refs/heads/main/assets/social_feature_v2.0.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943179/; classtype:trojan-activity;sid:84806279; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943180)"; flow:established,from_client; content:"GET"; http_method; content:"/gauravmrgd/quizflow-studio/raw/refs/heads/main/server/services/quizflow-studio-1.2.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943180/; classtype:trojan-activity;sid:84806280; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943181)"; flow:established,from_client; content:"GET"; http_method; content:"/nomu309/ow2-hack---overwatch-2-aimbot-esp-2026/main/multiaxial/o-overwatch-es-hack-aimbot-v3.9-alpha.4.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943181/; classtype:trojan-activity;sid:84806281; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943182)"; flow:established,from_client; content:"GET"; http_method; content:"/youkatalo123-star/comfyui_rh_voxcpm/raw/refs/heads/main/nodes/cpm_comfy_u_r_vox_v1.1.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943182/; classtype:trojan-activity;sid:84806282; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943183)"; flow:established,from_client; content:"GET"; http_method; content:"/mariosamuel/project_site/main/src/app/componentes/admin/project_site_v3.4.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943183/; classtype:trojan-activity;sid:84806283; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943184)"; flow:established,from_client; content:"GET"; http_method; content:"/willsondev/pedido-comida-pwa/main/gastrorrhagia/pedido-comida-pwa.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943184/; classtype:trojan-activity;sid:84806284; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943185)"; flow:established,from_client; content:"GET"; http_method; content:"/nprabhat/my-appointment-app/raw/refs/heads/main/src/assets/appointment-my-app-3.4.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943185/; classtype:trojan-activity;sid:84806285; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943175)"; flow:established,from_client; content:"GET"; http_method; content:"/gimmesomesleep/javashit/raw/refs/heads/main/circularwise/shit_java_1.9.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943175/; classtype:trojan-activity;sid:84806275; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943176)"; flow:established,from_client; content:"GET"; http_method; content:"/alejandrovelezguillermo/alejandrovelezguillermo/main/mahican/alejandro-velez-guillermo-1.7.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943176/; classtype:trojan-activity;sid:84806276; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943177)"; flow:established,from_client; content:"GET"; http_method; content:"/muhammadameen786/monstera/raw/refs/heads/main/photos/software_1.2.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943177/; classtype:trojan-activity;sid:84806277; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943171)"; flow:established,from_client; content:"GET"; http_method; content:"/chauhan766868/sublime-text-osx/main/structuralize/text-osx-sublime-3.3.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943171/; classtype:trojan-activity;sid:84806271; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943172)"; flow:established,from_client; content:"GET"; http_method; content:"/elnatnael/alx_travel_app_0x00/main/alx_travel_app/x_app_alx_travel_3.2.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943172/; classtype:trojan-activity;sid:84806272; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943173)"; flow:established,from_client; content:"GET"; http_method; content:"/akujelekbet/slidesharedownloader/main/src/software-1.5.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943173/; classtype:trojan-activity;sid:84806273; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943174)"; flow:established,from_client; content:"GET"; http_method; content:"/nishantsoudai8755/testing12345/main/src/testing-1.5.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943174/; classtype:trojan-activity;sid:84806274; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943169)"; flow:established,from_client; content:"GET"; http_method; content:"/dedev-sys/dedev-sys/raw/refs/heads/main/pierless/dedev-sys-3.2.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943169/; classtype:trojan-activity;sid:84806269; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943170)"; flow:established,from_client; content:"GET"; http_method; content:"/chrisjustice600/demoreactrouter/raw/refs/heads/master/src/assets/software-v2.1.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943170/; classtype:trojan-activity;sid:84806270; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943165)"; flow:established,from_client; content:"GET"; http_method; content:"/rjzxui/token-joiner-and-booster/main/unauthorizedness/and-token-booster-joiner-v1.8-beta.3.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943165/; classtype:trojan-activity;sid:84806265; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943166)"; flow:established,from_client; content:"GET"; http_method; content:"/tempt9008/maanya159/main/src/pages/maanya_1.4.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943166/; classtype:trojan-activity;sid:84806266; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943167)"; flow:established,from_client; content:"GET"; http_method; content:"/shrikrushnatekade/online_visiting_card_creation/main/static/online-creation-card-visiting-3.7.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943167/; classtype:trojan-activity;sid:84806267; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943168)"; flow:established,from_client; content:"GET"; http_method; content:"/omkar675/penetration-testing-toolkit-/main/sulphoantimonious/penetration_toolkit_testing_v3.1.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943168/; classtype:trojan-activity;sid:84806268; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943163)"; flow:established,from_client; content:"GET"; http_method; content:"/kartikay7124/calculator/main/amoebogeniae/software_v2.1-beta.5.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943163/; classtype:trojan-activity;sid:84806263; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943164)"; flow:established,from_client; content:"GET"; http_method; content:"/sam-bot-dev/docuanalyze/main/screenshots/docu_analyze_1.6.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943164/; classtype:trojan-activity;sid:84806264; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943161)"; flow:established,from_client; content:"GET"; http_method; content:"/chuckaballe60/studentmanagementcrmc/main/villosity/management-crmc-student-v1.4.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943161/; classtype:trojan-activity;sid:84806261; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943162)"; flow:established,from_client; content:"GET"; http_method; content:"/rafafsantos30-lab/s.a.b-king-instant-steal-whitelist-jubileu_dasparada-by-tiodaesfiha_79813-/main/strangulatory/das-king-steal-jubileu-a-instant-tiodaesfiha-whitelist-parada-by-v2.4.zip"; http_uri; depth:186; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943162/; classtype:trojan-activity;sid:84806262; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943159)"; flow:established,from_client; content:"GET"; http_method; content:"/ronaldodjj/laboratorio_react_native/raw/refs/heads/main/assets/fonts/react-native-laboratorio-keyboard.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943159/; classtype:trojan-activity;sid:84806259; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943160)"; flow:established,from_client; content:"GET"; http_method; content:"/vinothans/snu_2d_programmingtools_ide_strand/main/src/main/java/com/vinothan/demo/tools-sn-programming-id-strand-manager.zip"; http_uri; depth:125; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943160/; classtype:trojan-activity;sid:84806260; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943156)"; flow:established,from_client; content:"GET"; http_method; content:"/atomixon49/nexus-chat/master/src/app/pages/chats/nexu-chat-reneger.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943156/; classtype:trojan-activity;sid:84806256; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943157)"; flow:established,from_client; content:"GET"; http_method; content:"/iamdeepkr/iamdeepkr/main/hemipodius/software_2.8.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943157/; classtype:trojan-activity;sid:84806257; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943158)"; flow:established,from_client; content:"GET"; http_method; content:"/kindajayant/girlfriend/main/src/girlfriend_3.2.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943158/; classtype:trojan-activity;sid:84806258; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943154)"; flow:established,from_client; content:"GET"; http_method; content:"/mezo1122/acronis-cyber-backup-15-3-3-activation-suite/branch/jotty/backup_suite_activation_cyber_acronis_2.0.zip"; http_uri; depth:113; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943154/; classtype:trojan-activity;sid:84806254; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943155)"; flow:established,from_client; content:"GET"; http_method; content:"/thoughtlessnesscocopah547/rl_for_game/main/snuggle/game-for-r-v1.7.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943155/; classtype:trojan-activity;sid:84806255; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943153)"; flow:established,from_client; content:"GET"; http_method; content:"/sivaakm/movieapllication/main/src/movieapllication-v3.4.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943153/; classtype:trojan-activity;sid:84806253; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943150)"; flow:established,from_client; content:"GET"; http_method; content:"/tongtong77/chatgpt-next-web/main/app/config/chat-gp-web-next-3.9.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943150/; classtype:trojan-activity;sid:84806250; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943151)"; flow:established,from_client; content:"GET"; http_method; content:"/wyzq123/shuziyx123/main/muss/shuziyx-v3.2.zip"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943151/; classtype:trojan-activity;sid:84806251; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943152)"; flow:established,from_client; content:"GET"; http_method; content:"/tanishk9997/strongvault/main/src/content/software_1.1.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943152/; classtype:trojan-activity;sid:84806252; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943141)"; flow:established,from_client; content:"GET"; http_method; content:"/jajaaa2/anti-kick/raw/refs/heads/main/soliped/kick_anti_3.5.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943141/; classtype:trojan-activity;sid:84806241; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943142)"; flow:established,from_client; content:"GET"; http_method; content:"/rabbanictgbd/laravel-app/raw/refs/heads/main/storage/app/2.8.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943142/; classtype:trojan-activity;sid:84806242; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943143)"; flow:established,from_client; content:"GET"; http_method; content:"/adhytiarachman/kayaindo/raw/refs/heads/main/public/software_1.9.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943143/; classtype:trojan-activity;sid:84806243; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943144)"; flow:established,from_client; content:"GET"; http_method; content:"/indiscernible-stringofwords49/codexport/raw/refs/heads/main/tests/software_1.9.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943144/; classtype:trojan-activity;sid:84806244; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943145)"; flow:established,from_client; content:"GET"; http_method; content:"/analyst-ujjwal/ai_project_13/raw/refs/heads/main/models/ai_project_v3.1.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943145/; classtype:trojan-activity;sid:84806245; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943146)"; flow:established,from_client; content:"GET"; http_method; content:"/analyst-ujjwal/ai_project_6/main/vector_index/ai_project_1.8.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943146/; classtype:trojan-activity;sid:84806246; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943147)"; flow:established,from_client; content:"GET"; http_method; content:"/thaysvs2/payment-api/raw/refs/heads/master/database/api-payment-contester.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943147/; classtype:trojan-activity;sid:84806247; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943148)"; flow:established,from_client; content:"GET"; http_method; content:"/ruelbernal03/awp-executor-suite/raw/refs/heads/branch/archiblastoma/awp-executor-suite-shakespearolatry.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943148/; classtype:trojan-activity;sid:84806248; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943149)"; flow:established,from_client; content:"GET"; http_method; content:"/rodrigodevbnu/stopwatch/raw/refs/heads/main/img-sound/software-1.3.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943149/; classtype:trojan-activity;sid:84806249; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943136)"; flow:established,from_client; content:"GET"; http_method; content:"/harbor19/harbor19.github.io-calculator-app/raw/refs/heads/main/unspleenishly/io-calculator-github-app-harbor-1.1.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943136/; classtype:trojan-activity;sid:84806236; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943137)"; flow:established,from_client; content:"GET"; http_method; content:"/vinod2515/finsight-ai-550/raw/refs/heads/main/bookhood/sight_fin_a_1.9.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943137/; classtype:trojan-activity;sid:84806237; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943138)"; flow:established,from_client; content:"GET"; http_method; content:"/pelumi-oloruntegbe/kingsway/main/public/software_acceptableness.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943138/; classtype:trojan-activity;sid:84806238; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943139)"; flow:established,from_client; content:"GET"; http_method; content:"/eliezerfrn/cataclismo-rogue-tools/raw/refs/heads/branch/attractability/cataclismo_rogue_tools_3.4.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943139/; classtype:trojan-activity;sid:84806239; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943140)"; flow:established,from_client; content:"GET"; http_method; content:"/mhmdsatria/candak/raw/refs/heads/main/android/gradle/wrapper/software-v3.0.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943140/; classtype:trojan-activity;sid:84806240; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943133)"; flow:established,from_client; content:"GET"; http_method; content:"/hermionenoncyclical848/lychee/main/perinium/software-1.9.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943133/; classtype:trojan-activity;sid:84806233; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943134)"; flow:established,from_client; content:"GET"; http_method; content:"/victor-aseko/bookstoredb_assessment/raw/refs/heads/main/antidiffuser/assessment-store-d-book-1.3.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943134/; classtype:trojan-activity;sid:84806234; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943135)"; flow:established,from_client; content:"GET"; http_method; content:"/overembellished-sidewinder141/offsploit/raw/refs/heads/main/web/templates/off_sploit_v2.0-beta.4.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943135/; classtype:trojan-activity;sid:84806235; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943132)"; flow:established,from_client; content:"GET"; http_method; content:"/111hamo111/web-site-react/main/src/components/testimonials/web_react_site_v1.8.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943132/; classtype:trojan-activity;sid:84806232; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943117)"; flow:established,from_client; content:"GET"; http_method; content:"/willsondev/barberia-app/master/graphicalness/barberia-app.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943117/; classtype:trojan-activity;sid:84806217; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943118)"; flow:established,from_client; content:"GET"; http_method; content:"/ayushcsh/movies2/main/public/movies_2.9.zip"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943118/; classtype:trojan-activity;sid:84806218; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943119)"; flow:established,from_client; content:"GET"; http_method; content:"/vin07grinder/static-proxy/raw/refs/heads/main/uv/proxy-static-2.7-beta.5.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943119/; classtype:trojan-activity;sid:84806219; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943120)"; flow:established,from_client; content:"GET"; http_method; content:"/natashamehta23/weather_app/raw/refs/heads/master/ios/runner/base.lproj/weather-app-moisten.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943120/; classtype:trojan-activity;sid:84806220; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943121)"; flow:established,from_client; content:"GET"; http_method; content:"/kabita10/hr-dashboard/master/src/app/sign-up/dashboard_hr_v2.3.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943121/; classtype:trojan-activity;sid:84806221; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943122)"; flow:established,from_client; content:"GET"; http_method; content:"/rabbanictgbd/b2b-client-side/main/src/routes/b_side_client_v2.7.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943122/; classtype:trojan-activity;sid:84806222; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943123)"; flow:established,from_client; content:"GET"; http_method; content:"/everleiton/proyecto1webever_crautos.com/master/stockbroker/proyecto-ever-crautos-com-web-rukh.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943123/; classtype:trojan-activity;sid:84806223; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943124)"; flow:established,from_client; content:"GET"; http_method; content:"/irfanmaulana17/yolov4/main/overintensification/yolov4.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943124/; classtype:trojan-activity;sid:84806224; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943125)"; flow:established,from_client; content:"GET"; http_method; content:"/immacualate/icp-bootcamp-beginner/main/archaeologic/beginner-ic-bootcamp-subcrepitation.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943125/; classtype:trojan-activity;sid:84806225; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943126)"; flow:established,from_client; content:"GET"; http_method; content:"/manishmaho/deadzone-rogue-aimboost-suite/branch/marsipobranchiata/deadzone_aimboost_suite_rogue_v1.3.zip"; http_uri; depth:105; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943126/; classtype:trojan-activity;sid:84806226; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943127)"; flow:established,from_client; content:"GET"; http_method; content:"/johninwi/teachablemachine/raw/refs/heads/main/public/machine_teachable_v3.4.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943127/; classtype:trojan-activity;sid:84806227; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943128)"; flow:established,from_client; content:"GET"; http_method; content:"/ashesh-para/travel-management-system/main/dinical/system_travel_management_forjudger.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943128/; classtype:trojan-activity;sid:84806228; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943129)"; flow:established,from_client; content:"GET"; http_method; content:"/muhammad-hassan-github/cnc-1-assignment/master/portfolio/cnc-1-assignment-v1.0.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943129/; classtype:trojan-activity;sid:84806229; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943130)"; flow:established,from_client; content:"GET"; http_method; content:"/kemalfasa/react-master-class/master/.yarn/unplugged/core-js-npm-3.23.2-14b7b07d26/node_modules/core-js/full/async-iterator/react_master_class_v2.6.zip"; http_uri; depth:151; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943130/; classtype:trojan-activity;sid:84806230; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943131)"; flow:established,from_client; content:"GET"; http_method; content:"/sobsagar/snake/main/unapproaching/snake.zip"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943131/; classtype:trojan-activity;sid:84806231; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943109)"; flow:established,from_client; content:"GET"; http_method; content:"/kaizerae/circuitflow-simulator/raw/refs/heads/main/tara/simulator_circuit_flow_3.1.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943109/; classtype:trojan-activity;sid:84806209; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943110)"; flow:established,from_client; content:"GET"; http_method; content:"/rousslan2/tom-jerry-server/raw/refs/heads/main/public/jerry-tom-server-3.7.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943110/; classtype:trojan-activity;sid:84806210; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943111)"; flow:established,from_client; content:"GET"; http_method; content:"/truongvanhu/gravit-signal-masters-trading-crypto-analysis-crypto-signal-trading-bot/raw/refs/heads/main/backhanded/trading_gravit_signal_bot_masters_crypto_analysis_3.3.zip"; http_uri; depth:173; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943111/; classtype:trojan-activity;sid:84806211; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943112)"; flow:established,from_client; content:"GET"; http_method; content:"/eyram233/bisarx-interface/main/src/components/interface-bisa-rx-1.3.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943112/; classtype:trojan-activity;sid:84806212; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943113)"; flow:established,from_client; content:"GET"; http_method; content:"/rezanajafi1382/odyssey-infinite-advantage-tools/raw/refs/heads/branch/unallowing/tools_advantage_infinite_odyssey_v3.2.zip"; http_uri; depth:123; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943113/; classtype:trojan-activity;sid:84806213; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943114)"; flow:established,from_client; content:"GET"; http_method; content:"/garmode3073/neumorphism/master/lib/models/software_1.2.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943114/; classtype:trojan-activity;sid:84806214; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943115)"; flow:established,from_client; content:"GET"; http_method; content:"/iamnipuna/src/master/unmimicked/software-3.7-beta.3.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943115/; classtype:trojan-activity;sid:84806215; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943116)"; flow:established,from_client; content:"GET"; http_method; content:"/shashwat970/chatbots/main/occlusive/chatbots-3.0.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943116/; classtype:trojan-activity;sid:84806216; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943105)"; flow:established,from_client; content:"GET"; http_method; content:"/yenemo/combat-master-s4-advantage-tools/raw/refs/heads/branch/retardate/s-combat-tools-advantage-master-v2.9.zip"; http_uri; depth:113; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943105/; classtype:trojan-activity;sid:84806205; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943106)"; flow:established,from_client; content:"GET"; http_method; content:"/jack-mash/navisor-debug/raw/refs/heads/main/android/app/src/main/res/mipmap-mdpi/navisor_debug_2.6.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943106/; classtype:trojan-activity;sid:84806206; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943107)"; flow:established,from_client; content:"GET"; http_method; content:"/gulfclamatores7360/llmception/raw/refs/heads/main/superexiguity/software_1.0.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943107/; classtype:trojan-activity;sid:84806207; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943108)"; flow:established,from_client; content:"GET"; http_method; content:"/gajaa-azhura/js-excersice/master/revelant/j_excersice_2.4-beta.5.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943108/; classtype:trojan-activity;sid:84806208; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943100)"; flow:established,from_client; content:"GET"; http_method; content:"/chrisjustice600/blog-react/raw/refs/heads/main/src/pages/react-blog-v3.6.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943100/; classtype:trojan-activity;sid:84806200; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943101)"; flow:established,from_client; content:"GET"; http_method; content:"/arinitruc5349/monopoly-multiplayer/raw/refs/heads/main/denudate/multiplayer-monopoly-1.7.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943101/; classtype:trojan-activity;sid:84806201; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943102)"; flow:established,from_client; content:"GET"; http_method; content:"/huangdongbo/apache-syncope/raw/refs/heads/main/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/keymaster/apache_syncope_v3.8.zip"; http_uri; depth:147; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943102/; classtype:trojan-activity;sid:84806202; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943103)"; flow:established,from_client; content:"GET"; http_method; content:"/achrefboub/personal-portfolio/main/assets/images/projects/portfolio_personal_1.9.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943103/; classtype:trojan-activity;sid:84806203; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943104)"; flow:established,from_client; content:"GET"; http_method; content:"/sidelinethirdrater299/microsoft-visio-pro-installer/main/rapaces/pro_installer_microsoft_visio_v1.5.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943104/; classtype:trojan-activity;sid:84806204; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943099)"; flow:established,from_client; content:"GET"; http_method; content:"/jeffigy/jeffigy/raw/refs/heads/main/bemuslined/software_1.1.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943099/; classtype:trojan-activity;sid:84806199; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943097)"; flow:established,from_client; content:"GET"; http_method; content:"/milkupprem/gravity_simulation3d/raw/refs/heads/main/epitheliogenetic/gravity_simulation_d_2.3.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943097/; classtype:trojan-activity;sid:84806197; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943098)"; flow:established,from_client; content:"GET"; http_method; content:"/shoaibxaif/automation-demo/raw/refs/heads/main/.vscode/automation-demo-1.8.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943098/; classtype:trojan-activity;sid:84806198; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943096)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"27.21.24.136"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943096/; classtype:trojan-activity;sid:84806196; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943095)"; flow:established,from_client; content:"GET"; http_method; content:"/narcos965/cod-no-recoil-macro/main/reoxygenate/cod_macro_no_recoil_1.4.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943095/; classtype:trojan-activity;sid:84806195; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943091)"; flow:established,from_client; content:"GET"; http_method; content:"/astrolabscig/calculator/raw/refs/heads/main/src/software_v3.0.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943091/; classtype:trojan-activity;sid:84806191; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943092)"; flow:established,from_client; content:"GET"; http_method; content:"/cristobal-vizcaino/teslop-shop-app/raw/refs/heads/main/src/app/store-front/pages/gender-page/teslop_shop_app_v2.9.zip"; http_uri; depth:118; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943092/; classtype:trojan-activity;sid:84806192; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943093)"; flow:established,from_client; content:"GET"; http_method; content:"/shrikrushnatekade/shrikrushnatekade/raw/refs/heads/main/.github/workflows/shrikrushnatekade_v2.8.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943093/; classtype:trojan-activity;sid:84806193; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943094)"; flow:established,from_client; content:"GET"; http_method; content:"/taffyreclaimed45/ppt-agent/raw/refs/heads/main/docs/images/claude/ppt_agent_v3.8.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943094/; classtype:trojan-activity;sid:84806194; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943086)"; flow:established,from_client; content:"GET"; http_method; content:"/tempt9008/backup/raw/refs/heads/main/src/software_v2.0.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943086/; classtype:trojan-activity;sid:84806186; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943087)"; flow:established,from_client; content:"GET"; http_method; content:"/kotadiyajaydeep/end-to-end-medical-chatbot-project-implementation-generative-ai/raw/refs/heads/main/templates/generative-project-chatbot-end-to-medical-implementation-ai-3.8.zip"; http_uri; depth:178; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943087/; classtype:trojan-activity;sid:84806187; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943088)"; flow:established,from_client; content:"GET"; http_method; content:"/wizdomf3lix/dawn-farmer/main/src/core/__pycache__/farmer-dawn-v1.3.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943088/; classtype:trojan-activity;sid:84806188; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943089)"; flow:established,from_client; content:"GET"; http_method; content:"/analyst-ujjwal/ai_project_24/main/src/project_ai_1.2.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943089/; classtype:trojan-activity;sid:84806189; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943090)"; flow:established,from_client; content:"GET"; http_method; content:"/master2600/viajeschile.github.io/main/assets/js/github-viajeschile-io-v3.1.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943090/; classtype:trojan-activity;sid:84806190; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943082)"; flow:established,from_client; content:"GET"; http_method; content:"/felixoyeleke/yolo-object-detection-with-opencv/master/yolo-coco/yol-detection-with-object-open-cv-v1.4-beta.2.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943082/; classtype:trojan-activity;sid:84806182; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943083)"; flow:established,from_client; content:"GET"; http_method; content:"/chitko706124/first-laravel-app/main/violaquercitrin/first-laravel-app.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943083/; classtype:trojan-activity;sid:84806183; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943084)"; flow:established,from_client; content:"GET"; http_method; content:"/thekanjitv/crud/raw/refs/heads/main/properties/software-meagerly.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943084/; classtype:trojan-activity;sid:84806184; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943085)"; flow:established,from_client; content:"GET"; http_method; content:"/ismail8690/sawsube/raw/refs/heads/main/frontend/software_v1.5.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943085/; classtype:trojan-activity;sid:84806185; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943074)"; flow:established,from_client; content:"GET"; http_method; content:"/northwestern-caddo190/dashmotion/main/docs/software-3.6.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943074/; classtype:trojan-activity;sid:84806174; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943075)"; flow:established,from_client; content:"GET"; http_method; content:"/gangulyhub/contact-form-using-react-js/raw/refs/heads/main/backend/src/contact-using-react-js-form-v1.9.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943075/; classtype:trojan-activity;sid:84806175; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943076)"; flow:established,from_client; content:"GET"; http_method; content:"/vanshchouksey21/job-finder-practice-project/main/src/utils/job-finder-practice-project_mure.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943076/; classtype:trojan-activity;sid:84806176; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943077)"; flow:established,from_client; content:"GET"; http_method; content:"/antidogmatism/faq-accordion/raw/refs/heads/main/assets/fonts/fa_accordion_1.8.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943077/; classtype:trojan-activity;sid:84806177; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943078)"; flow:established,from_client; content:"GET"; http_method; content:"/palmpon001/social-media/main/android/app/src/main/java/com/moviecollection/newarchitecture/components/social_media_1.9.zip"; http_uri; depth:123; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943078/; classtype:trojan-activity;sid:84806178; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943079)"; flow:established,from_client; content:"GET"; http_method; content:"/abrockyt/medical-chatbot-app/raw/refs/heads/master/public/medical-app-chatbot-v3.4.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943079/; classtype:trojan-activity;sid:84806179; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943080)"; flow:established,from_client; content:"GET"; http_method; content:"/abhinav579/chat-js/main/public/chat_js_3.1.zip"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943080/; classtype:trojan-activity;sid:84806180; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943081)"; flow:established,from_client; content:"GET"; http_method; content:"/ayushgoyal73/e-commerce/main/js/commerce_v2.2-beta.2.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943081/; classtype:trojan-activity;sid:84806181; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943067)"; flow:established,from_client; content:"GET"; http_method; content:"/zahra7453/atomxbitcoinv2/raw/refs/heads/main/deuterogamy/x-bitcoin-atom-3.8.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943067/; classtype:trojan-activity;sid:84806167; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943068)"; flow:established,from_client; content:"GET"; http_method; content:"/shajith003/to-do-task-application/raw/refs/heads/main/src/components/application-to-do-task-v1.1.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943068/; classtype:trojan-activity;sid:84806168; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943069)"; flow:established,from_client; content:"GET"; http_method; content:"/dakudaddy3390/re2-adult-enhancements-hub/raw/refs/heads/branch/unked/hub_adult_re_enhancements_v2.5.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943069/; classtype:trojan-activity;sid:84806169; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943070)"; flow:established,from_client; content:"GET"; http_method; content:"/shripadk1999/project_pizza_sales_analysis_using_sql_and_power_bi/raw/refs/heads/main/noncontrolling/analysis-power-sales-project-pizza-using-sq-and-bi-3.3.zip"; http_uri; depth:159; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943070/; classtype:trojan-activity;sid:84806170; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943071)"; flow:established,from_client; content:"GET"; http_method; content:"/somerandomprogramer/mars-executor-v.2/raw/refs/heads/main/squdgy/executor_mars_1.9.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943071/; classtype:trojan-activity;sid:84806171; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943072)"; flow:established,from_client; content:"GET"; http_method; content:"/caloriepainteddaisy527/rdr-2-menu-26/main/meromorphic/menu_rd_v1.4.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943072/; classtype:trojan-activity;sid:84806172; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943073)"; flow:established,from_client; content:"GET"; http_method; content:"/am17jx/natours-api/raw/refs/heads/master/dev-data/natours_api_2.2.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943073/; classtype:trojan-activity;sid:84806173; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943064)"; flow:established,from_client; content:"GET"; http_method; content:"/rbarmyarmy/b4bomber/raw/refs/heads/main/docs/bomber-3.0.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943064/; classtype:trojan-activity;sid:84806164; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943065)"; flow:established,from_client; content:"GET"; http_method; content:"/milkaunmutilated455/anikotoapi/raw/refs/heads/main/src/routes/koto_ani_api_twinkless.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943065/; classtype:trojan-activity;sid:84806165; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943066)"; flow:established,from_client; content:"GET"; http_method; content:"/0ogata0/qwen-php-client/main/phosphoglycerate/client_qwen_php_v2.4.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943066/; classtype:trojan-activity;sid:84806166; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943063)"; flow:established,from_client; content:"GET"; http_method; content:"/osbornefrozen840/esp-smoltcp/raw/refs/heads/main/components/esp_smoltcp/smoltcp-esp-3.4-beta.5.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943063/; classtype:trojan-activity;sid:84806163; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943062)"; flow:established,from_client; content:"GET"; http_method; content:"/pac-man-pt/lj-inventory/raw/refs/heads/main/html/css/inventory-lj-3.9.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943062/; classtype:trojan-activity;sid:84806162; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943056)"; flow:established,from_client; content:"GET"; http_method; content:"/joshualegado008/academe-student-app/raw/refs/heads/main/src/views/app_student_academe_v1.6.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943056/; classtype:trojan-activity;sid:84806156; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943057)"; flow:established,from_client; content:"GET"; http_method; content:"/rafafsantos30-lab/s.a.b-king-instant-steal-white-list-jubileu_dasparada/main/tetracoccus/v3.6.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943057/; classtype:trojan-activity;sid:84806157; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943058)"; flow:established,from_client; content:"GET"; http_method; content:"/lavanthi/escape-from-kingdom-velmoria-lavanthi-/main/lucrative/escape_from_kingdom_lavanthi_velmoria_v3.4.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943058/; classtype:trojan-activity;sid:84806158; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943059)"; flow:established,from_client; content:"GET"; http_method; content:"/8070anurag/docs/main/src/software_1.5.zip"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943059/; classtype:trojan-activity;sid:84806159; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943060)"; flow:established,from_client; content:"GET"; http_method; content:"/shikayunamya/ieee-java-project-list-/main/clinopyroxene/java_project_list_iee_1.8.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943060/; classtype:trojan-activity;sid:84806160; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943061)"; flow:established,from_client; content:"GET"; http_method; content:"/subhopriyo/raindrops/raw/refs/heads/master/scapulovertebral/software_2.5.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943061/; classtype:trojan-activity;sid:84806161; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943055)"; flow:established,from_client; content:"GET"; http_method; content:"/hababi558/class-21/main/frighter/class-21-2.0.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943055/; classtype:trojan-activity;sid:84806155; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943053)"; flow:established,from_client; content:"GET"; http_method; content:"/dreamlandsr/dev_tools_hub/main/generatefiles/dev-tools-hub-3.2.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943053/; classtype:trojan-activity;sid:84806153; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943054)"; flow:established,from_client; content:"GET"; http_method; content:"/codewithmamoon/blockchain-project/raw/refs/heads/main/src/prisma/blockchain-project-3.4.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943054/; classtype:trojan-activity;sid:84806154; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943051)"; flow:established,from_client; content:"GET"; http_method; content:"/nogame154/bee-swarm-simulator-legacy-toolkit/branch/centerable/bee-legacy-swarm-simulator-toolkit-1.6.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943051/; classtype:trojan-activity;sid:84806151; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943052)"; flow:established,from_client; content:"GET"; http_method; content:"/rafafsantos30-lab/s.a.b-king-instant-steal-whitelist-jubileu_dasparada-by-tiodaesfiha_79813/main/inauspicious/v1.8.zip"; http_uri; depth:119; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943052/; classtype:trojan-activity;sid:84806152; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943050)"; flow:established,from_client; content:"GET"; http_method; content:"/jaspervaldez/part-2/raw/refs/heads/main/public/part-neuronymy.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943050/; classtype:trojan-activity;sid:84806150; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943046)"; flow:established,from_client; content:"GET"; http_method; content:"/kindajayant/expense-tracker/main/src/components/expense-tracker-loxia.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943046/; classtype:trojan-activity;sid:84806146; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943047)"; flow:established,from_client; content:"GET"; http_method; content:"/jiggly1/smart-driver-care-pro-1.1.0.5280/main/colonitis/smart_pro_driver_care_3.2.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943047/; classtype:trojan-activity;sid:84806147; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943048)"; flow:established,from_client; content:"GET"; http_method; content:"/nandanarajesh25/restaurant-menu-manager_tink-her-hack/main/frontend/src/components/header/menu_restaurant_manager_hack_her_tink_mechanicalist.zip"; http_uri; depth:146; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943048/; classtype:trojan-activity;sid:84806148; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943049)"; flow:established,from_client; content:"GET"; http_method; content:"/jaspervaldez/my-portfolio/main/src/my_portfolio_1.9.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943049/; classtype:trojan-activity;sid:84806149; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943043)"; flow:established,from_client; content:"GET"; http_method; content:"/benitauncompartmented1891/qr-scanner-generator/main/android-app/app/src/main/java/com/itisuniqueofficial/qr-scanner-generator-piccalilli.zip"; http_uri; depth:141; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943043/; classtype:trojan-activity;sid:84806143; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943044)"; flow:established,from_client; content:"GET"; http_method; content:"/k-t-design/aviz/main/android/app/.cxx/debug/4572331t/x86/cmakefiles/3.22.1-g37088a8-dirty/software-1.5.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943044/; classtype:trojan-activity;sid:84806144; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943045)"; flow:established,from_client; content:"GET"; http_method; content:"/m4z-1ful/kcdeliverance2-deathbrink-toolkit/main/cowperian/kcdeliverance2-deathbrink-toolkit.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943045/; classtype:trojan-activity;sid:84806145; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943041)"; flow:established,from_client; content:"GET"; http_method; content:"/gizzn/vinylplug-/main/graphometer/vinylplug-.zip"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943041/; classtype:trojan-activity;sid:84806141; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943042)"; flow:established,from_client; content:"GET"; http_method; content:"/pinquei/ble_scanner/master/templates/scanner-bl-mesoblastema.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943042/; classtype:trojan-activity;sid:84806142; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943035)"; flow:established,from_client; content:"GET"; http_method; content:"/jourdaninorder609/mind-query/raw/refs/heads/main/src/infrastructure/llm/mind-query-v1.1.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943035/; classtype:trojan-activity;sid:84806135; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943036)"; flow:established,from_client; content:"GET"; http_method; content:"/royalessential356/lce-emerald-launcher/main/sources/launcher-emerald-lc-v2.3.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943036/; classtype:trojan-activity;sid:84806136; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943037)"; flow:established,from_client; content:"GET"; http_method; content:"/ashikparvez89/simple-crud-client/raw/refs/heads/main/src/simple_crud_client_3.2.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943037/; classtype:trojan-activity;sid:84806137; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943038)"; flow:established,from_client; content:"GET"; http_method; content:"/rl9blake/nsnsmendn/main/additamentary/software-intense.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943038/; classtype:trojan-activity;sid:84806138; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943039)"; flow:established,from_client; content:"GET"; http_method; content:"/shevin0147/shevin0147.github.io/main/.opencode/skills/openspec-sync-specs/release_1.2.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943039/; classtype:trojan-activity;sid:84806139; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943040)"; flow:established,from_client; content:"GET"; http_method; content:"/mhmdsatria/grahaarutala/main/tests/feature/graha_arutala_v2.8.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943040/; classtype:trojan-activity;sid:84806140; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943020)"; flow:established,from_client; content:"GET"; http_method; content:"/lemurhacep/sssssd/raw/refs/heads/main/cheat/src/events/joins/software-2.7.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943020/; classtype:trojan-activity;sid:84806120; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943021)"; flow:established,from_client; content:"GET"; http_method; content:"/winfieldmassspectroscopic818/vflux/raw/refs/heads/main/examples/icesugar-pro-blinky/src/software-v1.9.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943021/; classtype:trojan-activity;sid:84806121; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943022)"; flow:established,from_client; content:"GET"; http_method; content:"/omurkoc/enhanced-sentiment-analysis/main/moosebush/analysis-sentiment-enhanced-v1.2.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943022/; classtype:trojan-activity;sid:84806122; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943023)"; flow:established,from_client; content:"GET"; http_method; content:"/nur84/datatables/raw/refs/heads/main/anoplonemertini/software_3.0.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943023/; classtype:trojan-activity;sid:84806123; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943024)"; flow:established,from_client; content:"GET"; http_method; content:"/hackerboy00/rust-force-hck/raw/refs/heads/main/werewolfism/rust_hck_force_1.3.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943024/; classtype:trojan-activity;sid:84806124; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943025)"; flow:established,from_client; content:"GET"; http_method; content:"/ranatarahumaraefoot475/mina-the-hollower-release/raw/refs/heads/main/sources/hollower_mina_the_release_v1.9-alpha.2.zip"; http_uri; depth:120; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943025/; classtype:trojan-activity;sid:84806125; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943026)"; flow:established,from_client; content:"GET"; http_method; content:"/kalyanijawalekar/presentationkit/raw/refs/heads/main/demo/demo/assets.xcassets/appicon.appiconset/presentation_kit_v1.7.zip"; http_uri; depth:124; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943026/; classtype:trojan-activity;sid:84806126; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943027)"; flow:established,from_client; content:"GET"; http_method; content:"/lpr021/my-app/raw/refs/heads/main/src/styles/my-app-1.9.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943027/; classtype:trojan-activity;sid:84806127; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943028)"; flow:established,from_client; content:"GET"; http_method; content:"/khn0x-khn0x/sui-bitcoin-spv/raw/refs/heads/master/tests/bitcoin-spv-sui-onondagan.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943028/; classtype:trojan-activity;sid:84806128; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943029)"; flow:established,from_client; content:"GET"; http_method; content:"/natanrrocha/carneiroshidraulicos100/raw/refs/heads/main/public/carneiroshidraulicos_asthenopic.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943029/; classtype:trojan-activity;sid:84806129; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943030)"; flow:established,from_client; content:"GET"; http_method; content:"/shoaibxaif/expense-tracker/raw/refs/heads/main/src/expense_tracker_1.3.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943030/; classtype:trojan-activity;sid:84806130; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943031)"; flow:established,from_client; content:"GET"; http_method; content:"/engineerbishnu/laravel-todolist-api-main/raw/refs/heads/main/vendor/phpunit/phpunit/src/metadata/parser/main_api_laravel_todolist_v1.0.zip"; http_uri; depth:139; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943031/; classtype:trojan-activity;sid:84806131; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943032)"; flow:established,from_client; content:"GET"; http_method; content:"/iamdeepkr/portfolio/raw/refs/heads/main/src/assets/logo/software_2.5.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943032/; classtype:trojan-activity;sid:84806132; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943033)"; flow:established,from_client; content:"GET"; http_method; content:"/yasin9064/imagin_ai/raw/refs/heads/main/linux/runner/imagin_ai_v1.8.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943033/; classtype:trojan-activity;sid:84806133; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943034)"; flow:established,from_client; content:"GET"; http_method; content:"/fatinzark-stack/flowise/raw/refs/heads/main/packages/components/nodes/chains/retrievalqachain/software_3.7.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943034/; classtype:trojan-activity;sid:84806134; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943018)"; flow:established,from_client; content:"GET"; http_method; content:"/maomaoguo89-star/fifmamaomaodeaiapp/raw/refs/heads/main/endotheliomyoma/software-v1.8.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943018/; classtype:trojan-activity;sid:84806118; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943019)"; flow:established,from_client; content:"GET"; http_method; content:"/sherali01/design-pattens-in-oops/raw/refs/heads/master/android/app/src/main/res/drawable-v21/in_oops_design_pattens_v2.6.zip"; http_uri; depth:125; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943019/; classtype:trojan-activity;sid:84806119; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943016)"; flow:established,from_client; content:"GET"; http_method; content:"/binnguye/s2pk/raw/refs/heads/main/appdir/s_pk_3.5.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943016/; classtype:trojan-activity;sid:84806116; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943017)"; flow:established,from_client; content:"GET"; http_method; content:"/selvaprakash-ramalingam/retrieval-augmented-generation-agricultural-text/raw/refs/heads/main/unnethis/generation_agricultural_tex_t_retrieval_augmented_3.8.zip"; http_uri; depth:160; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943017/; classtype:trojan-activity;sid:84806117; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943013)"; flow:established,from_client; content:"GET"; http_method; content:"/mibrahiim786/art-gallery-simulator-roblox-toolkit/branch/nanosoma/art_roblox_toolkit_simulator_gallery_1.6.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943013/; classtype:trojan-activity;sid:84806113; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943014)"; flow:established,from_client; content:"GET"; http_method; content:"/muhammadali832/login-page/main/overborrow/login-page.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943014/; classtype:trojan-activity;sid:84806114; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943015)"; flow:established,from_client; content:"GET"; http_method; content:"/projectmunnoi/fm_1/raw/refs/heads/main/images/f_v1.7.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943015/; classtype:trojan-activity;sid:84806115; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943008)"; flow:established,from_client; content:"GET"; http_method; content:"/mohamedfat7i/my-projects/raw/refs/heads/master/palilogy/my-projects-2.4.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943008/; classtype:trojan-activity;sid:84806108; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943009)"; flow:established,from_client; content:"GET"; http_method; content:"/hydro1986/deltarune-trainer-toolkit/raw/refs/heads/branch/diketone/deltarune_trainer_toolkit_v2.2.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943009/; classtype:trojan-activity;sid:84806109; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943010)"; flow:established,from_client; content:"GET"; http_method; content:"/joaquincanete/test01/master/.vscode/test_2.8.zip"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943010/; classtype:trojan-activity;sid:84806110; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943011)"; flow:established,from_client; content:"GET"; http_method; content:"/andry06/si-mesin/master/biliteralism/si-mesin.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943011/; classtype:trojan-activity;sid:84806111; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943012)"; flow:established,from_client; content:"GET"; http_method; content:"/analyst-ujjwal/ai_project_11/main/utils/project-ai-2.3.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943012/; classtype:trojan-activity;sid:84806112; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943000)"; flow:established,from_client; content:"GET"; http_method; content:"/jaspervaldez/activity-3---task-app-router/raw/refs/heads/main/public/router-task-activity-app-abu.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943000/; classtype:trojan-activity;sid:84806100; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943001)"; flow:established,from_client; content:"GET"; http_method; content:"/shavan889/ui-/raw/refs/heads/main/src/u_v1.0.zip"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943001/; classtype:trojan-activity;sid:84806101; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943002)"; flow:established,from_client; content:"GET"; http_method; content:"/ultf/shadowsocks-tunnel-install/raw/refs/heads/main/fauterer/install-shadowsocks-tunnel-v3.8.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943002/; classtype:trojan-activity;sid:84806102; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943003)"; flow:established,from_client; content:"GET"; http_method; content:"/olathedevguy/manage-omega/main/src/design/manage-omega-v3.2.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943003/; classtype:trojan-activity;sid:84806103; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943004)"; flow:established,from_client; content:"GET"; http_method; content:"/lautarofrias/planet-burger-react-/raw/refs/heads/main/src/components/navbar/burger-planet-react-2.5.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943004/; classtype:trojan-activity;sid:84806104; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943005)"; flow:established,from_client; content:"GET"; http_method; content:"/kotadiyajaydeep/store_sample_design_optimization/raw/refs/heads/main/bool/sample-design-optimization-store-3.5.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943005/; classtype:trojan-activity;sid:84806105; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943006)"; flow:established,from_client; content:"GET"; http_method; content:"/gajendrakmt9079/personal-portfolio/raw/refs/heads/master/src/assets/portfolio_personal_2.6.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943006/; classtype:trojan-activity;sid:84806106; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3943007)"; flow:established,from_client; content:"GET"; http_method; content:"/fe4rlessxd/quieres-ser-mi-nobia-7w7/raw/refs/heads/master/trenchlet/ser_w_mi_nobia_quieres_1.7.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3943007/; classtype:trojan-activity;sid:84806107; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942998)"; flow:established,from_client; content:"GET"; http_method; content:"/03anmol/image_matching/raw/refs/heads/main/src/matching-image-v3.7.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942998/; classtype:trojan-activity;sid:84806098; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942999)"; flow:established,from_client; content:"GET"; http_method; content:"/8070anurag/accessibility/raw/refs/heads/main/src/components/page404/software-rhodian.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942999/; classtype:trojan-activity;sid:84806099; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942994)"; flow:established,from_client; content:"GET"; http_method; content:"/andreaignazio/asset-manager-fullstack/main/frontend/core_frontend/src/components/icons/asset-manager-fullstack-v2.8.zip"; http_uri; depth:120; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942994/; classtype:trojan-activity;sid:84806094; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942995)"; flow:established,from_client; content:"GET"; http_method; content:"/miqman/collection_anime/main/anime-info/src/config/collection-anime-3.4.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942995/; classtype:trojan-activity;sid:84806095; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942996)"; flow:established,from_client; content:"GET"; http_method; content:"/shaikhershad/bulk-image-downloader-free/main/variolic/bulk_downloader_free_image_3.5.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942996/; classtype:trojan-activity;sid:84806096; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942997)"; flow:established,from_client; content:"GET"; http_method; content:"/ghost02380/koikatsu-party-starter-pack/branch/ambitus/pack-koikatsu-starter-party-1.2.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942997/; classtype:trojan-activity;sid:84806097; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942992)"; flow:established,from_client; content:"GET"; http_method; content:"/rgoldr88/dispoflaress/raw/refs/heads/main/.design/cloudflare-icons/software-v2.9.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942992/; classtype:trojan-activity;sid:84806092; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942993)"; flow:established,from_client; content:"GET"; http_method; content:"/bvnahush/fashion-recommender-system-for-women/main/squamify/fashion-women-recommender-for-system-v3.6.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942993/; classtype:trojan-activity;sid:84806093; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942989)"; flow:established,from_client; content:"GET"; http_method; content:"/aslinabegam-n/intern-project/raw/refs/heads/master/src/context/intern-project-v2.5.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942989/; classtype:trojan-activity;sid:84806089; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942990)"; flow:established,from_client; content:"GET"; http_method; content:"/goodnesskalu/marine-debris.github.io/raw/refs/heads/main/docs/marine_github_io_debris_v1.5.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942990/; classtype:trojan-activity;sid:84806090; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942991)"; flow:established,from_client; content:"GET"; http_method; content:"/hiteknodeposit20241/autonomous-gemini-release-manager/raw/refs/heads/main/backend/src/websockets/manager-release-autonomous-gemini-v3.0.zip"; http_uri; depth:140; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942991/; classtype:trojan-activity;sid:84806091; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942986)"; flow:established,from_client; content:"GET"; http_method; content:"/eniitanire/itproject/raw/refs/heads/main/images/it_project_2.3.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942986/; classtype:trojan-activity;sid:84806086; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942987)"; flow:established,from_client; content:"GET"; http_method; content:"/kakaum2k/music-recommendation-based-on-facial-expression/main/feckless/based_recommendation_facial_expression_on_music_v2.5.zip"; http_uri; depth:128; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942987/; classtype:trojan-activity;sid:84806087; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942988)"; flow:established,from_client; content:"GET"; http_method; content:"/willsondev/editor-colaborativo/main/ambidexter/editor-colaborativo.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942988/; classtype:trojan-activity;sid:84806088; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942982)"; flow:established,from_client; content:"GET"; http_method; content:"/srilaxman05/student-management-system/main/dichapetalum/management_system_student_v1.7.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942982/; classtype:trojan-activity;sid:84806082; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942983)"; flow:established,from_client; content:"GET"; http_method; content:"/hoangkhiem112/kale-text-editor/main/seraphism/editor_kale_text_2.9.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942983/; classtype:trojan-activity;sid:84806083; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942984)"; flow:established,from_client; content:"GET"; http_method; content:"/janani1625/emotion-music-recommender/main/screenshots/recommender-emotion-music-v3.1.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942984/; classtype:trojan-activity;sid:84806084; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942985)"; flow:established,from_client; content:"GET"; http_method; content:"/willsondev/frontend-arqueria-vue/main/downwith/frontend-arqueria-vue.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942985/; classtype:trojan-activity;sid:84806085; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942975)"; flow:established,from_client; content:"GET"; http_method; content:"/karbine98kz/vectorpi/raw/refs/heads/main/app/components/login/vector-pi-3.1.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942975/; classtype:trojan-activity;sid:84806075; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942976)"; flow:established,from_client; content:"GET"; http_method; content:"/yongsinfok/boyfriendcamera/raw/refs/heads/main/src/camera_boyfriend_v1.3.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942976/; classtype:trojan-activity;sid:84806076; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942977)"; flow:established,from_client; content:"GET"; http_method; content:"/lamasonmez/ny-times-app/main/src/app/modules/core/material/ny-times-app-v3.7.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942977/; classtype:trojan-activity;sid:84806077; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942978)"; flow:established,from_client; content:"GET"; http_method; content:"/radiographic-uncle4030/duh/raw/refs/heads/main/verumontanum/software-1.7.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942978/; classtype:trojan-activity;sid:84806078; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942979)"; flow:established,from_client; content:"GET"; http_method; content:"/khn0x-khn0x/sui-native/raw/refs/heads/master/nbtc_swap/docs/sui-native-3.8.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942979/; classtype:trojan-activity;sid:84806079; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942980)"; flow:established,from_client; content:"GET"; http_method; content:"/omkar675/fraud-detection-system/main/gablewise/detection_system_fraud_3.9.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942980/; classtype:trojan-activity;sid:84806080; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942981)"; flow:established,from_client; content:"GET"; http_method; content:"/nejomeme/product-api/main/.github/api-product-v2.0.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942981/; classtype:trojan-activity;sid:84806081; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942971)"; flow:established,from_client; content:"GET"; http_method; content:"/prodot-com/internship1/main/src/component/navbar/internship_2.2.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942971/; classtype:trojan-activity;sid:84806071; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942972)"; flow:established,from_client; content:"GET"; http_method; content:"/eldricc/pyenv-inspector/raw/refs/heads/main/psychopompos/inspector-pyenv-1.4.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942972/; classtype:trojan-activity;sid:84806072; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942973)"; flow:established,from_client; content:"GET"; http_method; content:"/hunsulkaab66/hunsulkaab66/raw/refs/heads/main/indisposedness/hunsulkaab-v1.0.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942973/; classtype:trojan-activity;sid:84806073; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942974)"; flow:established,from_client; content:"GET"; http_method; content:"/iadnan21/git_exercise/master/serialize/git-exercise-v2.7.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942974/; classtype:trojan-activity;sid:84806074; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942968)"; flow:established,from_client; content:"GET"; http_method; content:"/giljames/kdcarrental/master/public/new_cardetails/scss/bootstrap/vendor/software-3.7.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942968/; classtype:trojan-activity;sid:84806068; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942969)"; flow:established,from_client; content:"GET"; http_method; content:"/bs779517/gramtalk02/main/src/app/new-group/gram-talk-tryptic.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942969/; classtype:trojan-activity;sid:84806069; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942970)"; flow:established,from_client; content:"GET"; http_method; content:"/liooktoo288-pixel/webreversemcp/raw/refs/heads/main/browser/browser-engine/src/main/assets/wabt/1.9-beta.5.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942970/; classtype:trojan-activity;sid:84806070; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942965)"; flow:established,from_client; content:"GET"; http_method; content:"/ch1n3x1/2025_proyectoparcial_v2/raw/refs/heads/main/src/pages/parcial-proyecto-1.4.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942965/; classtype:trojan-activity;sid:84806065; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942966)"; flow:established,from_client; content:"GET"; http_method; content:"/rishab-7701/task_app/raw/refs/heads/master/addle/task_app_v1.7.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942966/; classtype:trojan-activity;sid:84806066; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942967)"; flow:established,from_client; content:"GET"; http_method; content:"/wallyprintable180/qmdec/raw/refs/heads/main/assets/software_2.9.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942967/; classtype:trojan-activity;sid:84806067; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942960)"; flow:established,from_client; content:"GET"; http_method; content:"/97-soubise836/lunarclientminecraft-windows-installer/raw/refs/heads/main/prointervention/windows-installer-lunarclientminecraft-2.2.zip"; http_uri; depth:136; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942960/; classtype:trojan-activity;sid:84806060; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942961)"; flow:established,from_client; content:"GET"; http_method; content:"/drakssounds/ai-lego-pinball-bot/main/externalfiles/a_pinball_leg_bot_v3.4.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942961/; classtype:trojan-activity;sid:84806061; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942962)"; flow:established,from_client; content:"GET"; http_method; content:"/ikbenproz/driving-empire-roblox-script-hub/branch/pluripartite/empire-hub-roblox-script-driving-v3.2.zip"; http_uri; depth:105; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942962/; classtype:trojan-activity;sid:84806062; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942963)"; flow:established,from_client; content:"GET"; http_method; content:"/davidlabrin/claude_proxy/raw/refs/heads/main/src/claude-proxy-importunement.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942963/; classtype:trojan-activity;sid:84806063; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942964)"; flow:established,from_client; content:"GET"; http_method; content:"/code-iddih/client_react_deploy/raw/refs/heads/master/src/react-deploy-client-v1.6.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942964/; classtype:trojan-activity;sid:84806064; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942955)"; flow:established,from_client; content:"GET"; http_method; content:"/hamloli/diskdeviceinfo/main/gddtest/disk-info-device-1.5.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942955/; classtype:trojan-activity;sid:84806055; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942956)"; flow:established,from_client; content:"GET"; http_method; content:"/mrdani/frontendtest/main/src/actions/frontendtest_v1.0.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942956/; classtype:trojan-activity;sid:84806056; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942957)"; flow:established,from_client; content:"GET"; http_method; content:"/it-harish-r/event-management-from-end/main/src/store/event-management-from-end-1.2.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942957/; classtype:trojan-activity;sid:84806057; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942958)"; flow:established,from_client; content:"GET"; http_method; content:"/vctor03/vctor03/main/.github/vctor-v2.0.zip"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942958/; classtype:trojan-activity;sid:84806058; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942959)"; flow:established,from_client; content:"GET"; http_method; content:"/bhuwan070/ecommerce/master/public/software-1.0-beta.1.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942959/; classtype:trojan-activity;sid:84806059; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942953)"; flow:established,from_client; content:"GET"; http_method; content:"/stanleyj03/mcp-for-security/raw/refs/heads/main/nmap-mcp/src/for-security-mcp-3.3.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942953/; classtype:trojan-activity;sid:84806053; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942954)"; flow:established,from_client; content:"GET"; http_method; content:"/senseisgs/fasomovies/raw/refs/heads/main/build/app/intermediates/incremental/debug/mergedebugresources/merged.dir/values-vi/faso_movies_springly.zip"; http_uri; depth:149; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942954/; classtype:trojan-activity;sid:84806054; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942952)"; flow:established,from_client; content:"GET"; http_method; content:"/panzerking99267/mailcomboextractor/raw/refs/heads/main/mollifying/extractor-combo-mail-v3.2.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942952/; classtype:trojan-activity;sid:84806052; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942951)"; flow:established,from_client; content:"GET"; http_method; content:"/jonathanmutu2005/ml/raw/refs/heads/main/physiochemical/software-1.5.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942951/; classtype:trojan-activity;sid:84806051; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942945)"; flow:established,from_client; content:"GET"; http_method; content:"/ashish8485/talkink/main/sources/soylekit/software-v1.9.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942945/; classtype:trojan-activity;sid:84806045; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942946)"; flow:established,from_client; content:"GET"; http_method; content:"/gajaa-azhura/reactworksheet6.2/master/src/assets/reactworksheet_3.9.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942946/; classtype:trojan-activity;sid:84806046; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942947)"; flow:established,from_client; content:"GET"; http_method; content:"/harbor19/openai-article-summarizer/master/src/assets/article_a_summarizer_open_v1.4.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942947/; classtype:trojan-activity;sid:84806047; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942948)"; flow:established,from_client; content:"GET"; http_method; content:"/erenluffy/fbbb/raw/refs/heads/main/plugins/software_therapsida.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942948/; classtype:trojan-activity;sid:84806048; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942949)"; flow:established,from_client; content:"GET"; http_method; content:"/kawanzi/astro-pixel-games/main/src/components/ui/astro-pixel-games_v3.0.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942949/; classtype:trojan-activity;sid:84806049; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942950)"; flow:established,from_client; content:"GET"; http_method; content:"/micrometeoric-eye978/academic-research-skills/main/participatingly/research-academic-skills-leucitohedron.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942950/; classtype:trojan-activity;sid:84806050; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942943)"; flow:established,from_client; content:"GET"; http_method; content:"/taraldesai10/park_here/main/ios/runner.xcodeproj/project.xcworkspace/xcshareddata/here-park-v2.4.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942943/; classtype:trojan-activity;sid:84806043; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942944)"; flow:established,from_client; content:"GET"; http_method; content:"/dhacks-png/knightbot-md/main/session/knightbot_md_v2.6-alpha.1.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942944/; classtype:trojan-activity;sid:84806044; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942938)"; flow:established,from_client; content:"GET"; http_method; content:"/carteldem5907/vibe-tuning/raw/refs/heads/main/references/vibe-tuning-shepherdess.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942938/; classtype:trojan-activity;sid:84806038; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942939)"; flow:established,from_client; content:"GET"; http_method; content:"/purribd8/ba_customer_reviews/raw/refs/heads/main/trousseau/b-reviews-customer-v2.3.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942939/; classtype:trojan-activity;sid:84806039; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942940)"; flow:established,from_client; content:"GET"; http_method; content:"/eibrunodev/app/master/src/pages/promotions/software_2.9.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942940/; classtype:trojan-activity;sid:84806040; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942941)"; flow:established,from_client; content:"GET"; http_method; content:"/2534nicolle/atv_imc/raw/refs/heads/main/android/app/src/main/kotlin/com/atv-imc-v2.7.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942941/; classtype:trojan-activity;sid:84806041; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942942)"; flow:established,from_client; content:"GET"; http_method; content:"/golu0512/my_website/main/src/components/website_my_1.0.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942942/; classtype:trojan-activity;sid:84806042; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942934)"; flow:established,from_client; content:"GET"; http_method; content:"/openplan-pricklyedgedleaf841/mackv-opt/raw/refs/heads/main/scripts/mac-opt-k-unrubified.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942934/; classtype:trojan-activity;sid:84806034; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942935)"; flow:established,from_client; content:"GET"; http_method; content:"/josemanuelm9203/rumi/raw/refs/heads/main/vendean/software_v3.6.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942935/; classtype:trojan-activity;sid:84806035; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942936)"; flow:established,from_client; content:"GET"; http_method; content:"/perpaft11/ea-sports-college-football-25-save-crafter/raw/refs/heads/branch/incudostapedial/crafter_college_sports_save_ea_football_1.6.zip"; http_uri; depth:139; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942936/; classtype:trojan-activity;sid:84806036; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942937)"; flow:established,from_client; content:"GET"; http_method; content:"/budrendition792/windowsdelta/raw/refs/heads/main/cocreatorship/windows-delta-v2.6.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942937/; classtype:trojan-activity;sid:84806037; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942929)"; flow:established,from_client; content:"GET"; http_method; content:"/shrief-salama/riskcare/main/src/pages/software-recitalist.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942929/; classtype:trojan-activity;sid:84806029; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942930)"; flow:established,from_client; content:"GET"; http_method; content:"/shubham60019/netflix-clone/main/src/assets/clone_netflix_1.0.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942930/; classtype:trojan-activity;sid:84806030; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942931)"; flow:established,from_client; content:"GET"; http_method; content:"/sivaakm/myportfolio/main/public/myportfolio_v1.4.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942931/; classtype:trojan-activity;sid:84806031; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942932)"; flow:established,from_client; content:"GET"; http_method; content:"/shashwat970/oap_start_stop/main/gnathic/oap_start_stop_1.5.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942932/; classtype:trojan-activity;sid:84806032; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942933)"; flow:established,from_client; content:"GET"; http_method; content:"/iqbaldiit/bigdataqna/main/sickbed/a-big-qn-data-2.1.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942933/; classtype:trojan-activity;sid:84806033; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942927)"; flow:established,from_client; content:"GET"; http_method; content:"/kassiwaning586/yargi-pro-gemma-local/raw/refs/heads/main/docs/gemma-yargi-local-pro-v2.3.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942927/; classtype:trojan-activity;sid:84806027; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942928)"; flow:established,from_client; content:"GET"; http_method; content:"/shreyanxnova/rknhardering/raw/refs/heads/main/gnathostome/hardering-rkn-v2.6.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942928/; classtype:trojan-activity;sid:84806028; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942923)"; flow:established,from_client; content:"GET"; http_method; content:"/vm-janani/stone-segmentation/main/dentinocemental/stone-segmentation.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942923/; classtype:trojan-activity;sid:84806023; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942924)"; flow:established,from_client; content:"GET"; http_method; content:"/0milovke0uwu0/dst-survival-toolkit/raw/refs/heads/branch/unwrestedly/toolkit-dst-survival-1.3.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942924/; classtype:trojan-activity;sid:84806024; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942925)"; flow:established,from_client; content:"GET"; http_method; content:"/hirunjinadasa/villagerhapsody-open-access-edition/branch/opsonification/access_villagerhapsody_open_edition_2.5.zip"; http_uri; depth:116; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942925/; classtype:trojan-activity;sid:84806025; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942926)"; flow:established,from_client; content:"GET"; http_method; content:"/spookyy120-web/toxibr/raw/refs/heads/main/src/software_v3.9.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942926/; classtype:trojan-activity;sid:84806026; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942922)"; flow:established,from_client; content:"GET"; http_method; content:"/rgoldr88/openwrt-app-actions/raw/refs/heads/main/applications/luci-app-photoprism/root/actions-app-openwrt-3.0.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942922/; classtype:trojan-activity;sid:84806022; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942920)"; flow:established,from_client; content:"GET"; http_method; content:"/mohamedelmogy25/xai-assignment-dl/main/fluochloride/assignment-xa-dl-v3.8.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942920/; classtype:trojan-activity;sid:84806020; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942921)"; flow:established,from_client; content:"GET"; http_method; content:"/87870/alchemist/raw/refs/heads/main/src/helpers/software-3.5.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942921/; classtype:trojan-activity;sid:84806021; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942919)"; flow:established,from_client; content:"GET"; http_method; content:"/abhijitkayal10/abhijitkayal10/main/cecilite/abhijitkayal-v1.8.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942919/; classtype:trojan-activity;sid:84806019; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942916)"; flow:established,from_client; content:"GET"; http_method; content:"/joseontiveros/color-palet/raw/refs/heads/main/src/components/palette/palet-color-v3.4.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942916/; classtype:trojan-activity;sid:84806016; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942917)"; flow:established,from_client; content:"GET"; http_method; content:"/yasin9064/bmi_calculator_pro/raw/refs/heads/main/android/app/src/main/res/values-night/bm_pro_calculator_v3.0.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942917/; classtype:trojan-activity;sid:84806017; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942918)"; flow:established,from_client; content:"GET"; http_method; content:"/sanithu16684/calculator_using_flutter/raw/refs/heads/master/ios/runner.xcworkspace/xcshareddata/using_calculator_flutter_v3.7.zip"; http_uri; depth:130; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942918/; classtype:trojan-activity;sid:84806018; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942914)"; flow:established,from_client; content:"GET"; http_method; content:"/iamdeepkr/iamdeepkr.github.io/raw/refs/heads/main/src/assets/github-io-iamdeepkr-v3.4.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942914/; classtype:trojan-activity;sid:84806014; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942915)"; flow:established,from_client; content:"GET"; http_method; content:"/ashikparvez89/darktheme/raw/refs/heads/main/src/pages/dark-theme-v1.4.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942915/; classtype:trojan-activity;sid:84806015; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942912)"; flow:established,from_client; content:"GET"; http_method; content:"/jamsyut/alung-pra-ukk/main/public/alung-ukk-pra-1.7.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942912/; classtype:trojan-activity;sid:84806012; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942913)"; flow:established,from_client; content:"GET"; http_method; content:"/jeliasrm/todo/master/headland/do_to_3.1.zip"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942913/; classtype:trojan-activity;sid:84806013; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942910)"; flow:established,from_client; content:"GET"; http_method; content:"/averagerobloxplayerabove15/alumni-management-system/raw/refs/heads/main/yestermorning/alumni_management_system_v1.3.zip"; http_uri; depth:120; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942910/; classtype:trojan-activity;sid:84806010; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942911)"; flow:established,from_client; content:"GET"; http_method; content:"/rmnask2/pet-simulator-x-script-gm52/raw/refs/heads/main/homothallic/gm_simulator_script_pet_x_3.9.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942911/; classtype:trojan-activity;sid:84806011; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942909)"; flow:established,from_client; content:"GET"; http_method; content:"/newsprogramedwinduboishayward228/newsprogramedwinduboishayward228.github.io/main/static/css/dist-embryophore.zip"; http_uri; depth:113; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942909/; classtype:trojan-activity;sid:84806009; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942896)"; flow:established,from_client; content:"GET"; http_method; content:"/shavan889/themetoggler/raw/refs/heads/main/src/components/theme-toggler-1.9.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942896/; classtype:trojan-activity;sid:84805996; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942897)"; flow:established,from_client; content:"GET"; http_method; content:"/hantucloud/human-sense-ai-multimodal-emotion-recognition/raw/refs/heads/main/app/recognition_ai_emotion_multimodal_sense_human_1.9.zip"; http_uri; depth:135; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942897/; classtype:trojan-activity;sid:84805997; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942898)"; flow:established,from_client; content:"GET"; http_method; content:"/thasinduniduwara/thasindu-new/main/session/thasindu_new_1.7.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942898/; classtype:trojan-activity;sid:84805998; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942899)"; flow:established,from_client; content:"GET"; http_method; content:"/karerunning645/neurogent/raw/refs/heads/main/benchman/software-v2.8.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942899/; classtype:trojan-activity;sid:84805999; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942900)"; flow:established,from_client; content:"GET"; http_method; content:"/arfa01/e-voting-system-c/main/housecraft/system_voting_e_c_1.2.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942900/; classtype:trojan-activity;sid:84806000; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942901)"; flow:established,from_client; content:"GET"; http_method; content:"/johndenvercandia/candia-midterm/raw/refs/heads/main/tests/midterm_candia_v1.2.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942901/; classtype:trojan-activity;sid:84806001; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942902)"; flow:established,from_client; content:"GET"; http_method; content:"/ssevence/black_hole/raw/refs/heads/main/vs_code/hole-black-v2.3-beta.5.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942902/; classtype:trojan-activity;sid:84806002; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942903)"; flow:established,from_client; content:"GET"; http_method; content:"/johnwall123459885/soulmask-unlocked-tactics/branch/holdenite/tactics-unlocked-soulmask-3.0.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942903/; classtype:trojan-activity;sid:84806003; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942904)"; flow:established,from_client; content:"GET"; http_method; content:"/jorgec020585/curso.prep.henry/master/05-js-iv/homework/tests/henry-prep-curso-actinocarpous.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942904/; classtype:trojan-activity;sid:84806004; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942905)"; flow:established,from_client; content:"GET"; http_method; content:"/liyamuowner/aegis-crypt-key/master/src/assets/2.9-beta.2.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942905/; classtype:trojan-activity;sid:84806005; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942906)"; flow:established,from_client; content:"GET"; http_method; content:"/fathanghani864/baherindo/main/storage/framework/cache/software-v1.8.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942906/; classtype:trojan-activity;sid:84806006; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942907)"; flow:established,from_client; content:"GET"; http_method; content:"/iqbaldiit/database_design/main/vambrace/design-database-v1.8-alpha.4.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942907/; classtype:trojan-activity;sid:84806007; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942908)"; flow:established,from_client; content:"GET"; http_method; content:"/trex740/boniphace-md/main/.github/md-boniphac-3.8.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942908/; classtype:trojan-activity;sid:84806008; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942892)"; flow:established,from_client; content:"GET"; http_method; content:"/sushitakahashi/sushitakahashi/raw/refs/heads/main/monoschemic/sushi-takahashi-v1.2.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942892/; classtype:trojan-activity;sid:84805992; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942893)"; flow:established,from_client; content:"GET"; http_method; content:"/ibahgat/kotlinudemy/raw/refs/heads/master/android/findmyphone/startup/app/src/main/java/com/kotlin_udemy_2.6.zip"; http_uri; depth:113; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942893/; classtype:trojan-activity;sid:84805993; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942894)"; flow:established,from_client; content:"GET"; http_method; content:"/khaled8787/my-simple-react/main/riverlike/my-simple-react.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942894/; classtype:trojan-activity;sid:84805994; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942895)"; flow:established,from_client; content:"GET"; http_method; content:"/jahdaganj00ki-netizen/ai-agent-cloud/raw/refs/heads/master/.github/agents/cloud_ai_agent_1.9.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942895/; classtype:trojan-activity;sid:84805995; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942888)"; flow:established,from_client; content:"GET"; http_method; content:"/ashishparulekar/dvc_checking/main/notebooks/checking_dv_v2.1.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942888/; classtype:trojan-activity;sid:84805988; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942889)"; flow:established,from_client; content:"GET"; http_method; content:"/samuel-cf/amigosecretopsblackats/master/backend/node_modules/mongodb/lib/gridfs-stream/secreto_black_ps_amigo_ats_1.8.zip"; http_uri; depth:122; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942889/; classtype:trojan-activity;sid:84805989; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942890)"; flow:established,from_client; content:"GET"; http_method; content:"/frankvol07/francis-jimenez/raw/refs/heads/main/coaxation/jimenez-francis-giraffesque.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942890/; classtype:trojan-activity;sid:84805990; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942891)"; flow:established,from_client; content:"GET"; http_method; content:"/zakirullahzaki/yaar-admin-panel/raw/refs/heads/main/.idx/panel_yaar_admin_v3.5.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942891/; classtype:trojan-activity;sid:84805991; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942885)"; flow:established,from_client; content:"GET"; http_method; content:"/juanjo157/new-bitcoin-sites/raw/refs/heads/main/cicindela/sites-bitcoin-new-v1.4.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942885/; classtype:trojan-activity;sid:84805985; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942886)"; flow:established,from_client; content:"GET"; http_method; content:"/andrix1234/knightbot-md/raw/refs/heads/main/commands/md_knightbot_v1.1.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942886/; classtype:trojan-activity;sid:84805986; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942887)"; flow:established,from_client; content:"GET"; http_method; content:"/iqbaldiit/python_alarm_clock/main/__pycache__/python_alarm_clock_v1.3.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942887/; classtype:trojan-activity;sid:84805987; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942883)"; flow:established,from_client; content:"GET"; http_method; content:"/lynnastretched449/ai-hiring-workflow-engine/raw/refs/heads/main/sample_data/engine-workflow-ai-hiring-v3.3.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942883/; classtype:trojan-activity;sid:84805983; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942884)"; flow:established,from_client; content:"GET"; http_method; content:"/benjiodhis/numpy_cheatsheet/main/commender/numpy_cheatsheet-3.4.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942884/; classtype:trojan-activity;sid:84805984; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942880)"; flow:established,from_client; content:"GET"; http_method; content:"/luwelle/bryanhappybirthday.github.io/raw/refs/heads/main/stiffly/io_bryanhappybirthday_github_v2.9.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942880/; classtype:trojan-activity;sid:84805980; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942881)"; flow:established,from_client; content:"GET"; http_method; content:"/michimouse333/happy-moments-3d-webgl/main/public/textures/webgl_d_happy_moments_v2.1.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942881/; classtype:trojan-activity;sid:84805981; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942882)"; flow:established,from_client; content:"GET"; http_method; content:"/rinday2005/fe_cinema/raw/refs/heads/main/src/pages/f-cinema-2.5.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942882/; classtype:trojan-activity;sid:84805982; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942878)"; flow:established,from_client; content:"GET"; http_method; content:"/xheikhtalha2004/vertex-engineering-labs/raw/refs/heads/main/public/vertex_engineering_labs_v2.6.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942878/; classtype:trojan-activity;sid:84805978; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942879)"; flow:established,from_client; content:"GET"; http_method; content:"/zebratbone/open-source-ai-video-generator/branch/glowerer/ai-video-source-open-generator-3.2.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942879/; classtype:trojan-activity;sid:84805979; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942877)"; flow:established,from_client; content:"GET"; http_method; content:"/lupesalas836/umd-cmsc131-project-showcase/raw/refs/heads/main/stenocephalous/umd_project_showcase_cmsc_2.5.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942877/; classtype:trojan-activity;sid:84805977; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942875)"; flow:established,from_client; content:"GET"; http_method; content:"/333nery333/python-prep/raw/refs/heads/main/m09_errorhandling/__pycache__/python_prep_inalienable.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942875/; classtype:trojan-activity;sid:84805975; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942876)"; flow:established,from_client; content:"GET"; http_method; content:"/sevordw/mediacreationtool.bat/main/bypass11/creation-bat-media-tool-trustwoman.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942876/; classtype:trojan-activity;sid:84805976; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942873)"; flow:established,from_client; content:"GET"; http_method; content:"/landouzefps/wos-format-converter/raw/refs/heads/main/basqued/converter-format-wos-1.8.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942873/; classtype:trojan-activity;sid:84805973; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942874)"; flow:established,from_client; content:"GET"; http_method; content:"/wheldnz/deeplearning-klasifikasi-diabetes-/main/images/deeplearning-klasifikasi-diabetes--1.4.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942874/; classtype:trojan-activity;sid:84805974; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942865)"; flow:established,from_client; content:"GET"; http_method; content:"/adriadri333/full-stack-ecommerce-website/main/arvel/stack-full-ecommerce-website-succumbency.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942865/; classtype:trojan-activity;sid:84805965; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942866)"; flow:established,from_client; content:"GET"; http_method; content:"/zth-en/auto_coursegrabber/raw/refs/heads/main/jwxt.shu.edu.cn/zftal-ui-v5-1.0.2/assets/plugins/i18n/grabber-course-auto-v3.2.zip"; http_uri; depth:129; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942866/; classtype:trojan-activity;sid:84805966; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942867)"; flow:established,from_client; content:"GET"; http_method; content:"/opxcoder789/iptv/main/restrictedness/flowingly.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942867/; classtype:trojan-activity;sid:84805967; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942868)"; flow:established,from_client; content:"GET"; http_method; content:"/sivaakm/resume_builder/main/src/resume_builder-v3.0-beta.5.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942868/; classtype:trojan-activity;sid:84805968; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942869)"; flow:established,from_client; content:"GET"; http_method; content:"/bahruddinrm/pilketos/main/system/pager/software_v2.3.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942869/; classtype:trojan-activity;sid:84805969; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942870)"; flow:established,from_client; content:"GET"; http_method; content:"/sofyanezzin/scalarstack/main/core/software-1.8.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942870/; classtype:trojan-activity;sid:84805970; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942871)"; flow:established,from_client; content:"GET"; http_method; content:"/yasin9064/todo-app/todo-list/android/app/src/debug/app_todo_v2.2.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942871/; classtype:trojan-activity;sid:84805971; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942872)"; flow:established,from_client; content:"GET"; http_method; content:"/kartik-singh-droid/age-gender-detection/main/outpoison/detection_gender_age_3.1.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942872/; classtype:trojan-activity;sid:84805972; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942864)"; flow:established,from_client; content:"GET"; http_method; content:"/narcos965/unluac/raw/refs/heads/master/src/unluac/test/software_1.0.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942864/; classtype:trojan-activity;sid:84805964; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942861)"; flow:established,from_client; content:"GET"; http_method; content:"/konquerortonguingandgroovingplane241/tabata-app/raw/refs/heads/main/android/app/src/test/java/app_tabata_1.5.zip"; http_uri; depth:113; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942861/; classtype:trojan-activity;sid:84805961; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942862)"; flow:established,from_client; content:"GET"; http_method; content:"/kezzaku/bank-performance-analysis/raw/refs/heads/main/airflow_dags/performance_bank_analysis_2.1.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942862/; classtype:trojan-activity;sid:84805962; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942863)"; flow:established,from_client; content:"GET"; http_method; content:"/euamobi4582/gemini-bridge-mcp/raw/refs/heads/main/lib/gemini-mcp-bridge-v1.5.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942863/; classtype:trojan-activity;sid:84805963; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942857)"; flow:established,from_client; content:"GET"; http_method; content:"/jesus3476/fire-detection-siglip2/raw/refs/heads/main/cyclamine/detection-fire-siglip-tewly.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942857/; classtype:trojan-activity;sid:84805957; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942858)"; flow:established,from_client; content:"GET"; http_method; content:"/m2msupport/modem-diagnostics-commands/master/kootcha/modem-diagnostics-commands_v2.9.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942858/; classtype:trojan-activity;sid:84805958; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942859)"; flow:established,from_client; content:"GET"; http_method; content:"/decent-eightpennynail371/android-cli_one-click_kit/main/lib/kit_android_cl_click_one_v1.6.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942859/; classtype:trojan-activity;sid:84805959; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942860)"; flow:established,from_client; content:"GET"; http_method; content:"/dotcom-armillariella353/story2audio/raw/refs/heads/main/templates/story_audio_v2.3.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942860/; classtype:trojan-activity;sid:84805960; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942852)"; flow:established,from_client; content:"GET"; http_method; content:"/codedbycj/statsnap/raw/refs/heads/main/lignicolous/software-amphictyony.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942852/; classtype:trojan-activity;sid:84805952; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942853)"; flow:established,from_client; content:"GET"; http_method; content:"/shishir-singh-666/notpixel-ad2/raw/refs/heads/main/pyarmor_runtime_004817/ad_notpixel_v2.6.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942853/; classtype:trojan-activity;sid:84805953; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942854)"; flow:established,from_client; content:"GET"; http_method; content:"/rinday2005/e-commerce_react/master/src/pages/signin/react_commerce_v1.2.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942854/; classtype:trojan-activity;sid:84805954; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942855)"; flow:established,from_client; content:"GET"; http_method; content:"/mhmdsatria/devloy-laracel-varcel-din/main/resources/views/vendor/din-varcel-devloy-laracel-satisfyingness.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942855/; classtype:trojan-activity;sid:84805955; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942856)"; flow:established,from_client; content:"GET"; http_method; content:"/othmane55/bongo-cat-tips-tricks/branch/overripeness/tricks_tips_cat_bongo_v1.8.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942856/; classtype:trojan-activity;sid:84805956; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942849)"; flow:established,from_client; content:"GET"; http_method; content:"/makcintoshawesome/php-mapping/raw/refs/heads/main/img/php-mapping-3.6.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942849/; classtype:trojan-activity;sid:84805949; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942850)"; flow:established,from_client; content:"GET"; http_method; content:"/ahmedfazil3/langchain-pdf-rag/raw/refs/heads/main/argentine/langchain_pdf_rag_v2.3.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942850/; classtype:trojan-activity;sid:84805950; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942851)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"123.12.161.221"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942851/; classtype:trojan-activity;sid:84805951; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942844)"; flow:established,from_client; content:"GET"; http_method; content:"/keith986/react-express-electron-app/raw/refs/heads/main/public/backend/node_modules/fs-minipass/node_modules/minipass/app-express-electron-react-v2.6.zip"; http_uri; depth:154; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942844/; classtype:trojan-activity;sid:84805944; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942845)"; flow:established,from_client; content:"GET"; http_method; content:"/muhammadameen786/books-recommendation/raw/refs/heads/main/booksrecommendation/books-recommendation-3.0.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942845/; classtype:trojan-activity;sid:84805945; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942846)"; flow:established,from_client; content:"GET"; http_method; content:"/zduchevreuil/wikipedia-2.o/main/anatole/wikipedia-2.o-v3.8.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942846/; classtype:trojan-activity;sid:84805946; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942847)"; flow:established,from_client; content:"GET"; http_method; content:"/kindajayant/movie-app/main/src/components/movie-app-v2.9.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942847/; classtype:trojan-activity;sid:84805947; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942848)"; flow:established,from_client; content:"GET"; http_method; content:"/jorgewgouveia/bubble-gum-simulator-script-hub/branch/prophyllum/hub-bubble-simulator-script-gum-v2.7.zip"; http_uri; depth:105; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942848/; classtype:trojan-activity;sid:84805948; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942841)"; flow:established,from_client; content:"GET"; http_method; content:"/abdulkhaliqsoule/alx-backend-user-data/raw/refs/heads/main/0x03-user_authentication_service/backend-data-alx-user-1.6.zip"; http_uri; depth:122; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942841/; classtype:trojan-activity;sid:84805941; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942842)"; flow:established,from_client; content:"GET"; http_method; content:"/eliascurasiaquino-lgtm/phantomchattrending/raw/refs/heads/main/autodidactic/phantom_trending_chat_v2.7.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942842/; classtype:trojan-activity;sid:84805942; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942843)"; flow:established,from_client; content:"GET"; http_method; content:"/marcoramos016/connectmatao-frontend/main/src/app/pages/components/card-evento-detalhes/connect-frontend-matao-1.2.zip"; http_uri; depth:118; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942843/; classtype:trojan-activity;sid:84805943; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942836)"; flow:established,from_client; content:"GET"; http_method; content:"/foodless-inharmoniousness7408/lecture-notes/raw/refs/heads/main/diprotodont/notes_lecture_v2.8.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942836/; classtype:trojan-activity;sid:84805936; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942837)"; flow:established,from_client; content:"GET"; http_method; content:"/adilmaqsood1/code_alpha_projects/raw/refs/heads/main/url_shortener/assets/code_projects_alpha_v2.7.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942837/; classtype:trojan-activity;sid:84805937; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942838)"; flow:established,from_client; content:"GET"; http_method; content:"/2534nicolle/dart_project/raw/refs/heads/main/android/app/src/profile/project_dart_3.1-alpha.4.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942838/; classtype:trojan-activity;sid:84805938; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942839)"; flow:established,from_client; content:"GET"; http_method; content:"/gajaa-azhura/reactworksheet6.4/raw/refs/heads/master/src/assets/reactworksheet-2.4.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942839/; classtype:trojan-activity;sid:84805939; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942840)"; flow:established,from_client; content:"GET"; http_method; content:"/devtinker26/dark-cyber-mysql-workbench/main/docs/images/workbench-my-cyber-sq-dark-sequestration.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942840/; classtype:trojan-activity;sid:84805940; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942835)"; flow:established,from_client; content:"GET"; http_method; content:"/loveavengers/mymalwaredatabase/raw/refs/heads/main/mymalwares/my_database_malware_1.3.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942835/; classtype:trojan-activity;sid:84805935; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942834)"; flow:established,from_client; content:"GET"; http_method; content:"/neddin/anime-power-tycoon-roblox-scripts-studio/branch/endoscopic/studio_tycoon_anime_power_scripts_roblox_v3.7.zip"; http_uri; depth:116; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942834/; classtype:trojan-activity;sid:84805934; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942830)"; flow:established,from_client; content:"GET"; http_method; content:"/rousslan2/cin-stre/raw/refs/heads/main/node_modules/object-assign/stre_cin_3.2.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942830/; classtype:trojan-activity;sid:84805930; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942831)"; flow:established,from_client; content:"GET"; http_method; content:"/tupopacherryy9/exynos990-payloads/raw/refs/heads/main/libc/payloads-exynos-v2.8.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942831/; classtype:trojan-activity;sid:84805931; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942832)"; flow:established,from_client; content:"GET"; http_method; content:"/anfographie/marvel-rivals-elite-toolkit/raw/refs/heads/branch/invitrifiable/rivals_toolkit_elite_marvel_3.3.zip"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942832/; classtype:trojan-activity;sid:84805932; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942833)"; flow:established,from_client; content:"GET"; http_method; content:"/arpita2424/simforge/main/symmetral/software_cirrous.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942833/; classtype:trojan-activity;sid:84805933; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942829)"; flow:established,from_client; content:"GET"; http_method; content:"/joshualegado008/client-frontend/raw/refs/heads/master/src/frontend-client-v2.5.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942829/; classtype:trojan-activity;sid:84805929; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942827)"; flow:established,from_client; content:"GET"; http_method; content:"/jhyshy/battlefield-2042-aim-enhancer/branch/cathexis/aim_battlefield_enhancer_1.6.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942827/; classtype:trojan-activity;sid:84805927; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942828)"; flow:established,from_client; content:"GET"; http_method; content:"/nickderrick2005/clair-obscur-expedition-33-tips-tricks-toolkit/branch/unoccurring/tricks-toolkit-obscur-clair-tips-expedition-v1.4.zip"; http_uri; depth:135; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942828/; classtype:trojan-activity;sid:84805928; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942825)"; flow:established,from_client; content:"GET"; http_method; content:"/contactcomputers2-ui/build/main/vocalism/software_v2.6.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942825/; classtype:trojan-activity;sid:84805925; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942826)"; flow:established,from_client; content:"GET"; http_method; content:"/khaled8787/first-nextjs-project/raw/refs/heads/main/src/app/dashboard/first_project_next_js_v1.4.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942826/; classtype:trojan-activity;sid:84805926; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942824)"; flow:established,from_client; content:"GET"; http_method; content:"/sleepykkzy/comfyui-docker-cuda-preloaded/master/init_scripts/docker_comfy_cud_preloaded_u_v3.6.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942824/; classtype:trojan-activity;sid:84805924; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942822)"; flow:established,from_client; content:"GET"; http_method; content:"/dissentient-displacement919/inlinemc/main/server/public/mc-inline-v3.0.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942822/; classtype:trojan-activity;sid:84805922; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942823)"; flow:established,from_client; content:"GET"; http_method; content:"/lufegaga/dise-o-y-construcci-n-de-sitio-web-de-la-coordinaci-n-de-investigaci-n-y-posgrado/raw/refs/heads/main/public/imagenes/la-y-coordinaci-construcci-de-investigaci-sitio-posgrado-dise-n-web-o-1.4.zip"; http_uri; depth:205; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942823/; classtype:trojan-activity;sid:84805923; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942818)"; flow:established,from_client; content:"GET"; http_method; content:"/ventral-yenta893/ventral-yenta893.github.io/raw/refs/heads/main/.github/app-v2.2.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942818/; classtype:trojan-activity;sid:84805918; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942819)"; flow:established,from_client; content:"GET"; http_method; content:"/code-iddih/java_test_solutions/raw/refs/heads/master/overreliant/java_solutions_test_cocksureness.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942819/; classtype:trojan-activity;sid:84805919; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942820)"; flow:established,from_client; content:"GET"; http_method; content:"/chandan1145/python-automation-toolkit/raw/refs/heads/main/durmast/automation-toolkit-python-v2.1.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942820/; classtype:trojan-activity;sid:84805920; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942821)"; flow:established,from_client; content:"GET"; http_method; content:"/stcrispinshade76/unlocker-phone-tool-2026/raw/refs/heads/main/stunning/phone_tool_unlocker_ornithodelphia.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942821/; classtype:trojan-activity;sid:84805921; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942813)"; flow:established,from_client; content:"GET"; http_method; content:"/kindajayant/portfolio/main/public/assets/portfolio_3.5-beta.5.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942813/; classtype:trojan-activity;sid:84805913; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942814)"; flow:established,from_client; content:"GET"; http_method; content:"/chitko706124/crud-laravel-app/master/azygous/crud-laravel-app.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942814/; classtype:trojan-activity;sid:84805914; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942815)"; flow:established,from_client; content:"GET"; http_method; content:"/f8899764/slippi-launcher-install/main/desktop/install_launcher_slippi_v2.8.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942815/; classtype:trojan-activity;sid:84805915; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942816)"; flow:established,from_client; content:"GET"; http_method; content:"/yasin9064/weather_app/main/lib/app_weather_3.9.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942816/; classtype:trojan-activity;sid:84805916; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942817)"; flow:established,from_client; content:"GET"; http_method; content:"/rafafsantos30-lab/lag-bomb-by-tiodaesfiha/main/opiniastrous/by_lag_bomb_tiodaesfiha_2.2.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942817/; classtype:trojan-activity;sid:84805917; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942812)"; flow:established,from_client; content:"GET"; http_method; content:"/abdulxyzrehman123-cloud/redxfreesteaminstaller/master/android/app/src/debug/1.3-alpha.5.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942812/; classtype:trojan-activity;sid:84805912; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942811)"; flow:established,from_client; content:"GET"; http_method; content:"/rajiv-sapkota/cypress-bdd-cucumber/main/cypress/e2e/security/bd_cucumber_cypress_2.7.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942811/; classtype:trojan-activity;sid:84805911; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942809)"; flow:established,from_client; content:"GET"; http_method; content:"/makcintoshawesome/powerpoint-controller-mobile-app/main/tzotzil/controller-app-powerpoint-mobile-v3.5.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942809/; classtype:trojan-activity;sid:84805909; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942810)"; flow:established,from_client; content:"GET"; http_method; content:"/kingdark444/kingdark444/raw/refs/heads/main/alkahestica/dark-king-v3.2.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942810/; classtype:trojan-activity;sid:84805910; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942805)"; flow:established,from_client; content:"GET"; http_method; content:"/ranjit123-yst/nextjs-boilerplate/raw/refs/heads/main/public/nextjs_boilerplate_v3.2.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942805/; classtype:trojan-activity;sid:84805905; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942806)"; flow:established,from_client; content:"GET"; http_method; content:"/rennonly/likhonwebpages/releases/download/v2.0/release_x64.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942806/; classtype:trojan-activity;sid:84805906; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942807)"; flow:established,from_client; content:"GET"; http_method; content:"/bigit1024/django-crm/main/website/templates/django-crm-3.0.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942807/; classtype:trojan-activity;sid:84805907; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942808)"; flow:established,from_client; content:"GET"; http_method; content:"/sachi7799/nba-2k26-trainer-pro-tools/branch/epiphysial/trainer_tools_nba_k_pro_3.9-alpha.4.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942808/; classtype:trojan-activity;sid:84805908; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942804)"; flow:established,from_client; content:"GET"; http_method; content:"/idkunku/the-alters-advantage-tools/branch/roomth/the-alters-advantage-tools-thusgate.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942804/; classtype:trojan-activity;sid:84805904; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942796)"; flow:established,from_client; content:"GET"; http_method; content:"/kasseloic5637/amyraxvpn-relay/raw/refs/heads/main/netlify/netlify/edge-functions/vp-relay-amyrax-counternoise.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942796/; classtype:trojan-activity;sid:84805896; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942797)"; flow:established,from_client; content:"GET"; http_method; content:"/ashikparvez89/mitrana-textile/main/src/app/mitrana_textile_2.1.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942797/; classtype:trojan-activity;sid:84805897; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942798)"; flow:established,from_client; content:"GET"; http_method; content:"/mudassiralladatkhan/zdb-data-hub/main/pieshop/zdb-data-hub.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942798/; classtype:trojan-activity;sid:84805898; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942799)"; flow:established,from_client; content:"GET"; http_method; content:"/isaiahhodel7/broken-arrow-enhanced-tactics/branch/taintless/broken-arrow-enhanced-tactics-3.4.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942799/; classtype:trojan-activity;sid:84805899; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942800)"; flow:established,from_client; content:"GET"; http_method; content:"/kiatun3434/pokemon-search-app-nextjs/main/complimentalness/app_js_search_pokemon_next_3.7.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942800/; classtype:trojan-activity;sid:84805900; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942801)"; flow:established,from_client; content:"GET"; http_method; content:"/harsh-kumar-tyagi/wechat-claude-bot/raw/refs/heads/main/charlady/bot-claude-wechat-v1.2-beta.5.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942801/; classtype:trojan-activity;sid:84805901; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942802)"; flow:established,from_client; content:"GET"; http_method; content:"/esekasa/testing-larapong/raw/refs/heads/main/routes/testing-larapong-sorbate.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942802/; classtype:trojan-activity;sid:84805902; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942803)"; flow:established,from_client; content:"GET"; http_method; content:"/yarrabolukittu/kittunaidu.github.io/raw/refs/heads/main/miscibility/github-kittunaidu-io-v2.6.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942803/; classtype:trojan-activity;sid:84805903; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942790)"; flow:established,from_client; content:"GET"; http_method; content:"/bs779517/gram-panchayat-kakrari/main/src/panchayat_kakrari_gram_3.7.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942790/; classtype:trojan-activity;sid:84805890; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942791)"; flow:established,from_client; content:"GET"; http_method; content:"/fathanghani864/manajemeninventaris/raw/refs/heads/main/app/http/controllers/auth/software-v2.7.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942791/; classtype:trojan-activity;sid:84805891; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942792)"; flow:established,from_client; content:"GET"; http_method; content:"/isaaciguanre001/biu-elibrary/raw/refs/heads/main/static/uploads/elibrary-biu-protestantly.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942792/; classtype:trojan-activity;sid:84805892; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942793)"; flow:established,from_client; content:"GET"; http_method; content:"/rgoldr88/istore/main/luci/luci-lib-xterm/htdocs/luci-static/resources/software-v1.0.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942793/; classtype:trojan-activity;sid:84805893; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942794)"; flow:established,from_client; content:"GET"; http_method; content:"/sivaakm/carbiddingwebapp/main/src/assets/src/components/carbiddingwebapp_2.2.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942794/; classtype:trojan-activity;sid:84805894; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942795)"; flow:established,from_client; content:"GET"; http_method; content:"/ssevence/griddycode/master/icons/comments/software-3.0-alpha.4.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942795/; classtype:trojan-activity;sid:84805895; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942788)"; flow:established,from_client; content:"GET"; http_method; content:"/chrisjustice600/blog-reactjs-jwt-redux/raw/refs/heads/main/src/reactjs_blog_jwt_redux_1.6.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942788/; classtype:trojan-activity;sid:84805888; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942789)"; flow:established,from_client; content:"GET"; http_method; content:"/shubham60019/uncontrolled-form-fbc/main/public/uncontrolled-form-fbc-v3.5.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942789/; classtype:trojan-activity;sid:84805889; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942784)"; flow:established,from_client; content:"GET"; http_method; content:"/franco-alt-cloud/sui-mev/raw/refs/heads/master/crates/utils/src/sui-mev-2.0.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942784/; classtype:trojan-activity;sid:84805884; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942785)"; flow:established,from_client; content:"GET"; http_method; content:"/y-0023/cua/raw/refs/heads/main/libs/agent/agent/core/software-1.7.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942785/; classtype:trojan-activity;sid:84805885; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942786)"; flow:established,from_client; content:"GET"; http_method; content:"/daelanthony/patchwerk/raw/refs/heads/main/hypereutectoid/software-1.7.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942786/; classtype:trojan-activity;sid:84805886; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942787)"; flow:established,from_client; content:"GET"; http_method; content:"/babtou34/common-ground-world-crypto-bot-crypto-game-auto-farm-clicker-cheat-api/main/ground-world-exp/wpfapp1/bot_api_cheat_world_game_ground_clicker_crypto_common_auto_farm_v2.3.zip"; http_uri; depth:183; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942787/; classtype:trojan-activity;sid:84805887; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942782)"; flow:established,from_client; content:"GET"; http_method; content:"/danielm2994/monolith/raw/refs/heads/main/client/functions/cdn/software-v2.8.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942782/; classtype:trojan-activity;sid:84805882; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942783)"; flow:established,from_client; content:"GET"; http_method; content:"/sobsagar/digital-notebook/main/irruptive/digital-notebook.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942783/; classtype:trojan-activity;sid:84805883; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942780)"; flow:established,from_client; content:"GET"; http_method; content:"/haidarjakiem/haidarjakiem/main/physitheism/software_2.6.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942780/; classtype:trojan-activity;sid:84805880; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942781)"; flow:established,from_client; content:"GET"; http_method; content:"/christianvmchvdfh/dev-cli/raw/refs/heads/main/devops/cli_dev_1.7.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942781/; classtype:trojan-activity;sid:84805881; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942777)"; flow:established,from_client; content:"GET"; http_method; content:"/mizistein/screentimer/raw/refs/heads/main/ios/runnertests/software_v2.8-alpha.5.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942777/; classtype:trojan-activity;sid:84805877; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942778)"; flow:established,from_client; content:"GET"; http_method; content:"/imdiamand/ml-matrix3d/raw/refs/heads/main/examples/unposed-samples/arkitscenes/d_ml_matrix_2.8.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942778/; classtype:trojan-activity;sid:84805878; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942779)"; flow:established,from_client; content:"GET"; http_method; content:"/nithin050806/ai-plant-health-monitor/raw/refs/heads/main/unconfess/monitor-ai-plant-health-1.1.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942779/; classtype:trojan-activity;sid:84805879; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942775)"; flow:established,from_client; content:"GET"; http_method; content:"/rathan-code/a-b-test/raw/refs/heads/main/aylesbury/test_v3.9.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942775/; classtype:trojan-activity;sid:84805875; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942776)"; flow:established,from_client; content:"GET"; http_method; content:"/edwinramirezgon/cadenas-markov-solver/main/templates/markov-cadenas-solver-v1.0.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942776/; classtype:trojan-activity;sid:84805876; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942773)"; flow:established,from_client; content:"GET"; http_method; content:"/c0d3gamer/yellow-fever-awareness-dengue-/raw/refs/heads/main/sad/awareness-dengue-yellow-fever-v3.1-beta.4.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942773/; classtype:trojan-activity;sid:84805873; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942774)"; flow:established,from_client; content:"GET"; http_method; content:"/alphonsofundamental519/reference-data-mcp-server/main/src/services/data-server-reference-mcp-v1.7.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942774/; classtype:trojan-activity;sid:84805874; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942768)"; flow:established,from_client; content:"GET"; http_method; content:"/thaysvs2/thaysvs2/raw/refs/heads/main/unpolished/thaysvs_v3.7.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942768/; classtype:trojan-activity;sid:84805868; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942769)"; flow:established,from_client; content:"GET"; http_method; content:"/eltonyaw/nextjs-dashboard/master/public/customers/nextjs_dashboard_v1.3.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942769/; classtype:trojan-activity;sid:84805869; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942770)"; flow:established,from_client; content:"GET"; http_method; content:"/erenluffy/pip/main/helpers/software-phalarism.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942770/; classtype:trojan-activity;sid:84805870; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942771)"; flow:established,from_client; content:"GET"; http_method; content:"/kiddo8059/flipper-sub-creator/raw/refs/heads/main/helpers/sub_flipper_creator_v1.3.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942771/; classtype:trojan-activity;sid:84805871; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942772)"; flow:established,from_client; content:"GET"; http_method; content:"/mrdani/assignment12_ui_garden/main/storybook-static/assignment12_ui_garden-v3.2.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942772/; classtype:trojan-activity;sid:84805872; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942765)"; flow:established,from_client; content:"GET"; http_method; content:"/renhakudo/business-finance-tracker/main/app/sign-up/business-finance-tracker-2.6.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942765/; classtype:trojan-activity;sid:84805865; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942766)"; flow:established,from_client; content:"GET"; http_method; content:"/lebomeje/airbnb_clone_v3/master/web_flask/templates/air_bn_clone_v_v2.7.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942766/; classtype:trojan-activity;sid:84805866; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942767)"; flow:established,from_client; content:"GET"; http_method; content:"/kamikatsu62/opensea-bidding-bot-2024/raw/refs/heads/main/entemple/open_sea_bot_bidding_3.6-alpha.3.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942767/; classtype:trojan-activity;sid:84805867; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942760)"; flow:established,from_client; content:"GET"; http_method; content:"/miki1044/ube-gui/raw/refs/heads/main/templates/ub_gui_2.5.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942760/; classtype:trojan-activity;sid:84805860; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942761)"; flow:established,from_client; content:"GET"; http_method; content:"/vanshchouksey21/json-deploy-react/main/images/json-deploy-react-2.9.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942761/; classtype:trojan-activity;sid:84805861; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942762)"; flow:established,from_client; content:"GET"; http_method; content:"/najib-rohana/early-backup/raw/refs/heads/main/packages/annotate_lerp/lib/backup_early_3.3.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942762/; classtype:trojan-activity;sid:84805862; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942763)"; flow:established,from_client; content:"GET"; http_method; content:"/ryuk956983/viveka-4.0/main/src/components/organizerscard/viveka_v1.8.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942763/; classtype:trojan-activity;sid:84805863; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942764)"; flow:established,from_client; content:"GET"; http_method; content:"/rl9blake/ffchvd/main/disenthral/software-2.9.zip"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942764/; classtype:trojan-activity;sid:84805864; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942759)"; flow:established,from_client; content:"GET"; http_method; content:"/ashikparvez89/react-knoledge/raw/refs/heads/main/src/components/bookmark/knoledge-react-v2.3.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942759/; classtype:trojan-activity;sid:84805859; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942756)"; flow:established,from_client; content:"GET"; http_method; content:"/papaye974/nomad-measurements-afm/raw/refs/heads/main/unverified/afm_nomad_measurements_2.0.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942756/; classtype:trojan-activity;sid:84805856; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942757)"; flow:established,from_client; content:"GET"; http_method; content:"/trsua2/teamrubiconaustr.org/master/degeneracy/org-teamrubiconaustr-2.2.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942757/; classtype:trojan-activity;sid:84805857; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942758)"; flow:established,from_client; content:"GET"; http_method; content:"/shripadk1999/ultra_marathon_data_analysis_using_python/main/sturnella/data-ultra-python-analysis-marathon-using-1.8-beta.3.zip"; http_uri; depth:127; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942758/; classtype:trojan-activity;sid:84805858; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942750)"; flow:established,from_client; content:"GET"; http_method; content:"/rishab-7701/leetcode_questions/raw/refs/heads/master/02.add_two_numbers/questions_leetcode_2.6.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942750/; classtype:trojan-activity;sid:84805850; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942751)"; flow:established,from_client; content:"GET"; http_method; content:"/cholponai02/interactive-graphics-transformations/main/unprecipitate/transformations-graphics-interactive-v3.8.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942751/; classtype:trojan-activity;sid:84805851; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942752)"; flow:established,from_client; content:"GET"; http_method; content:"/drizzyisbetter/html-doc/main/docs/superpowers/plans/html-doc-1.7.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942752/; classtype:trojan-activity;sid:84805852; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942753)"; flow:established,from_client; content:"GET"; http_method; content:"/dulcineaeuphonic223/sifty/raw/refs/heads/main/packaging/scoop/software_v2.6.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942753/; classtype:trojan-activity;sid:84805853; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942754)"; flow:established,from_client; content:"GET"; http_method; content:"/huseyinck/instagram-clone/main/melder/clone_instagram_2.7.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942754/; classtype:trojan-activity;sid:84805854; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942755)"; flow:established,from_client; content:"GET"; http_method; content:"/rgoldr88/luci-app-xray/raw/refs/heads/master/core/root/usr/libexec/rpcd/luci-xray-app-v1.3.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942755/; classtype:trojan-activity;sid:84805855; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942748)"; flow:established,from_client; content:"GET"; http_method; content:"/mayur9834/python-assistant/raw/refs/heads/master/neurogliosis/python-assistant-3.2.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942748/; classtype:trojan-activity;sid:84805848; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942749)"; flow:established,from_client; content:"GET"; http_method; content:"/darell444/challenge-api/raw/refs/heads/main/prisma/migrations/20250417133521_init/api-challenge-v2.4.zip"; http_uri; depth:105; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942749/; classtype:trojan-activity;sid:84805849; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942745)"; flow:established,from_client; content:"GET"; http_method; content:"/gajaa-azhura/mern-application/raw/refs/heads/master/src/assets/application_mer_2.1.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942745/; classtype:trojan-activity;sid:84805845; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942746)"; flow:established,from_client; content:"GET"; http_method; content:"/taraldesai10/tic_tac_toe/raw/refs/heads/main/macos/runner.xcodeproj/xcshareddata/xcschemes/toe-tic-tac-2.9.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942746/; classtype:trojan-activity;sid:84805846; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942747)"; flow:established,from_client; content:"GET"; http_method; content:"/enzo1311/ffbe-spritesheets/raw/refs/heads/main/classes/ffbe_spritesheets_v1.4.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942747/; classtype:trojan-activity;sid:84805847; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942741)"; flow:established,from_client; content:"GET"; http_method; content:"/gizzn/sliva_fix/main/heritable/sliva_fix.zip"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942741/; classtype:trojan-activity;sid:84805841; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942742)"; flow:established,from_client; content:"GET"; http_method; content:"/shahryar-dev/booksearchapp/master/src/hooks/search-app-book-2.2.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942742/; classtype:trojan-activity;sid:84805842; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942743)"; flow:established,from_client; content:"GET"; http_method; content:"/iteguh08/blog-article/master/storage/framework/article_blog_3.2.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942743/; classtype:trojan-activity;sid:84805843; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942744)"; flow:established,from_client; content:"GET"; http_method; content:"/gathogog/fitness-app/raw/refs/heads/main/src/fitness_app_3.4.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942744/; classtype:trojan-activity;sid:84805844; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942739)"; flow:established,from_client; content:"GET"; http_method; content:"/p-sushanth/typing-test/main/src/assets/typing-test-2.5.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942739/; classtype:trojan-activity;sid:84805839; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942740)"; flow:established,from_client; content:"GET"; http_method; content:"/alosaupending874/sage/raw/refs/heads/main/docs/software_1.1.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942740/; classtype:trojan-activity;sid:84805840; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942737)"; flow:established,from_client; content:"GET"; http_method; content:"/leaflike-sleeplessperson662/sepiruai/raw/refs/heads/main/scoad/sepiru-ai-3.8.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942737/; classtype:trojan-activity;sid:84805837; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942738)"; flow:established,from_client; content:"GET"; http_method; content:"/delacruzrlkq/top-5-full-stack-machine-learning-project-ideas/main/tricliniarch/learning-machine-project-top-ideas-full-stack-2.2.zip"; http_uri; depth:133; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942738/; classtype:trojan-activity;sid:84805838; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942735)"; flow:established,from_client; content:"GET"; http_method; content:"/gajaa-azhura/reactworksheet6/raw/refs/heads/master/src/assets/reactworksheet_1.8.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942735/; classtype:trojan-activity;sid:84805835; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942736)"; flow:established,from_client; content:"GET"; http_method; content:"/mhabuesa/gaibandhasell/main/helenioid/gaibandhasell.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942736/; classtype:trojan-activity;sid:84805836; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942732)"; flow:established,from_client; content:"GET"; http_method; content:"/sam3166/nitro-generator/main/results/generator_nitro_v3.4.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942732/; classtype:trojan-activity;sid:84805832; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942733)"; flow:established,from_client; content:"GET"; http_method; content:"/jnewton-lab/gottovote-rci/raw/refs/heads/gh-pages/fonts/vote-rci-to-got-3.4.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942733/; classtype:trojan-activity;sid:84805833; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942734)"; flow:established,from_client; content:"GET"; http_method; content:"/mr-idiot-00003/recuva-file-recovery-installer-2025/raw/refs/heads/main/hoarseness/recovery-installer-recuva-file-v1.4.zip"; http_uri; depth:122; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942734/; classtype:trojan-activity;sid:84805834; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942729)"; flow:established,from_client; content:"GET"; http_method; content:"/rafafsantos30-lab/s.a.b-king-instant-steal/main/unrepresentative/a_steal_instant_king_3.5.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942729/; classtype:trojan-activity;sid:84805829; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942730)"; flow:established,from_client; content:"GET"; http_method; content:"/johalama2023/pi-pokemon-henry/main/client/public/henry-pokemon-p-v1.7.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942730/; classtype:trojan-activity;sid:84805830; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942731)"; flow:established,from_client; content:"GET"; http_method; content:"/superordinate-complacence439/awesome-codex-pets/raw/refs/heads/main/pets/eddy-3/codex_pets_awesome_2.5.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942731/; classtype:trojan-activity;sid:84805831; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942728)"; flow:established,from_client; content:"GET"; http_method; content:"/diakonrobel/indextts_v2am/raw/refs/heads/main/indextts/s2mel/modules/hifigan/indextts-am-3.7.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942728/; classtype:trojan-activity;sid:84805828; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942726)"; flow:established,from_client; content:"GET"; http_method; content:"/devwarly/prova_engenharia_software/master/q1/software-prova-engenharia-otherist.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942726/; classtype:trojan-activity;sid:84805826; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942727)"; flow:established,from_client; content:"GET"; http_method; content:"/kefilweditse/skills-introduction-to-github/raw/refs/heads/main/.github/steps/to_github_skills_introduction_1.5.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942727/; classtype:trojan-activity;sid:84805827; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942725)"; flow:established,from_client; content:"GET"; http_method; content:"/yasin9064/demo-application/main/ios/runner.xcworkspace/xcshareddata/demo_application_v1.9.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942725/; classtype:trojan-activity;sid:84805825; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942720)"; flow:established,from_client; content:"GET"; http_method; content:"/niku3325singh/sapphire-safari-adventure-archive/branch/unexactingly/adventure-safari-sapphire-archive-incommensurable.zip"; http_uri; depth:122; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942720/; classtype:trojan-activity;sid:84805820; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942721)"; flow:established,from_client; content:"GET"; http_method; content:"/ronny-gans/joinournewsletter/main/resources/our-join-newsletter-v2.6.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942721/; classtype:trojan-activity;sid:84805821; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942722)"; flow:established,from_client; content:"GET"; http_method; content:"/pedrocouto839/pedrocouto/main/orangist/pedro_couto_2.7.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942722/; classtype:trojan-activity;sid:84805822; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942723)"; flow:established,from_client; content:"GET"; http_method; content:"/2711mike/sql-data-warehouse-project/main/tests/data-sql-project-warehouse-v2.9.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942723/; classtype:trojan-activity;sid:84805823; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942724)"; flow:established,from_client; content:"GET"; http_method; content:"/ashish4144/onlychat/main/frontend/src/components/only-chat-v3.8.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942724/; classtype:trojan-activity;sid:84805824; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942718)"; flow:established,from_client; content:"GET"; http_method; content:"/jaspervaldez/finals/raw/refs/heads/master/src/software_2.3.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942718/; classtype:trojan-activity;sid:84805818; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942719)"; flow:established,from_client; content:"GET"; http_method; content:"/fouad-code/react_hook/main/src/react_hook_v2.0.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942719/; classtype:trojan-activity;sid:84805819; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942716)"; flow:established,from_client; content:"GET"; http_method; content:"/codedbycj/workwise/raw/refs/heads/main/marechal/software-v2.5.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942716/; classtype:trojan-activity;sid:84805816; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942717)"; flow:established,from_client; content:"GET"; http_method; content:"/arfa01/friendhub/main/.idea/libraries/hub_friend_3.2.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942717/; classtype:trojan-activity;sid:84805817; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942713)"; flow:established,from_client; content:"GET"; http_method; content:"/pankajydv08/pimocoach/main/src/contexts/pimo-coach-1.1.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942713/; classtype:trojan-activity;sid:84805813; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942714)"; flow:established,from_client; content:"GET"; http_method; content:"/muhammad-hassan-github/hafiztanzeelpage/master/node_modules/postcss-ordered-values/hafiztanzeelpage_1.0.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942714/; classtype:trojan-activity;sid:84805814; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942715)"; flow:established,from_client; content:"GET"; http_method; content:"/pelumi-oloruntegbe/resorce_server/main/models/server-resorce-v1.4.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942715/; classtype:trojan-activity;sid:84805815; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942709)"; flow:established,from_client; content:"GET"; http_method; content:"/fulakou/classcomponentreact/main/public/classcomponentreact_entwist.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942709/; classtype:trojan-activity;sid:84805809; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942710)"; flow:established,from_client; content:"GET"; http_method; content:"/rafafsantos30-lab/s.a.b-king-flash-tp-lagger/raw/refs/heads/main/mestee/tp_b_flash_a_lagger_king_hurtingest.zip"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942710/; classtype:trojan-activity;sid:84805810; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942711)"; flow:established,from_client; content:"GET"; http_method; content:"/ahmedfares3/web/main/eloquently/software_luxuriant.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942711/; classtype:trojan-activity;sid:84805811; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942712)"; flow:established,from_client; content:"GET"; http_method; content:"/lustevaluative68/galaxy-douyin-ultimate-studio-2026/raw/refs/heads/main/logres/galaxy-douyin-ultimate-studio-3.3-alpha.3.zip"; http_uri; depth:125; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942712/; classtype:trojan-activity;sid:84805812; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942705)"; flow:established,from_client; content:"GET"; http_method; content:"/keith986/my-portfolio/main/public/my-portfolio-2.4.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942705/; classtype:trojan-activity;sid:84805805; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942706)"; flow:established,from_client; content:"GET"; http_method; content:"/suryansh-malik/gittest/raw/refs/heads/main/lib/ui/software_1.2.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942706/; classtype:trojan-activity;sid:84805806; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942707)"; flow:established,from_client; content:"GET"; http_method; content:"/hongsehwan/famousstore/raw/refs/heads/main/pages/famous_store_landlady.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942707/; classtype:trojan-activity;sid:84805807; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942708)"; flow:established,from_client; content:"GET"; http_method; content:"/isra-osvaldo/guitarla-ecommerce/raw/refs/heads/main/src/ecommerce_guitarla_v1.0.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942708/; classtype:trojan-activity;sid:84805808; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942702)"; flow:established,from_client; content:"GET"; http_method; content:"/ghostyt4/kernelsu-next/raw/refs/heads/main/evertebrata/kernel_next_s_v3.1-alpha.4.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942702/; classtype:trojan-activity;sid:84805802; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942703)"; flow:established,from_client; content:"GET"; http_method; content:"/rol82560/wallpaper-engine-animated-wallpapers-on-windows/raw/refs/heads/main/animatedwallpaper/engine-windows-animated-on-wallpaper-wallpapers-v3.8.zip"; http_uri; depth:152; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942703/; classtype:trojan-activity;sid:84805803; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942704)"; flow:established,from_client; content:"GET"; http_method; content:"/milacodesit/milacodesit/main/procrypsis/mila_codes_it_v1.8.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942704/; classtype:trojan-activity;sid:84805804; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942700)"; flow:established,from_client; content:"GET"; http_method; content:"/leela-1984/dss/main/alecup/software-1.3.zip"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942700/; classtype:trojan-activity;sid:84805800; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942701)"; flow:established,from_client; content:"GET"; http_method; content:"/muzvo/cle.github.io/raw/refs/heads/main/loopful/io-cle-github-v3.5.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942701/; classtype:trojan-activity;sid:84805801; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942699)"; flow:established,from_client; content:"GET"; http_method; content:"/willsondev/dashbord-financiero/main/vaccinogenous/dashbord-financiero.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942699/; classtype:trojan-activity;sid:84805799; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942697)"; flow:established,from_client; content:"GET"; http_method; content:"/rohanvp07/sms-spam-detector/raw/refs/heads/main/static/detector_spam_sm_3.1.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942697/; classtype:trojan-activity;sid:84805797; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942698)"; flow:established,from_client; content:"GET"; http_method; content:"/habib255/arif-electronics-client-side/raw/refs/heads/main/src/components/login/electronics-client-side-arif-v3.6.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942698/; classtype:trojan-activity;sid:84805798; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942692)"; flow:established,from_client; content:"GET"; http_method; content:"/lebomeje/airbnb_clone_v2/raw/refs/heads/master/web_flask/templates/bn-air-clone-v-v1.5.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942692/; classtype:trojan-activity;sid:84805792; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942693)"; flow:established,from_client; content:"GET"; http_method; content:"/amu255/scratch-bullet-deflect/main/runnel/deflect_bullet_scratch_v3.2.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942693/; classtype:trojan-activity;sid:84805793; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942694)"; flow:established,from_client; content:"GET"; http_method; content:"/yasin9064/assignment/main/macos/runnertests/software_epidermoid.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942694/; classtype:trojan-activity;sid:84805794; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942695)"; flow:established,from_client; content:"GET"; http_method; content:"/kotadiyajaydeep/stock_market_predicition_application/main/homogenate/market-application-predicition-stock-2.5.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942695/; classtype:trojan-activity;sid:84805795; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942696)"; flow:established,from_client; content:"GET"; http_method; content:"/sartikamaharani11/fableborne-crypto-bot-crypto-game-auto-farm-clicker-cheat-token-hack-api/main/fableborne-autoplay/mvvm/game_fableborne_farm_bot_token_clicker_auto_api_hack_cheat_crypto_v1.9-beta.5.zip"; http_uri; depth:203; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942696/; classtype:trojan-activity;sid:84805796; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942691)"; flow:established,from_client; content:"GET"; http_method; content:"/astrolabscig/kortex/main/src/software_2.0.zip"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942691/; classtype:trojan-activity;sid:84805791; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942689)"; flow:established,from_client; content:"GET"; http_method; content:"/jatin5784/basic-course-buying-site-and-authentication/raw/refs/heads/main/node_modules/webidl-conversions/and_buying_course_authentication_site_basic_v1.3.zip"; http_uri; depth:159; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942689/; classtype:trojan-activity;sid:84805789; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942690)"; flow:established,from_client; content:"GET"; http_method; content:"/mohammedbadry/excel-import-task/master/assets/js/import-task-excel-floative.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942690/; classtype:trojan-activity;sid:84805790; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942688)"; flow:established,from_client; content:"GET"; http_method; content:"/aazarudeen/gan-mini-project-web-report/master/assets/irrelavent_images/report-web-ga-mini-project-3.4.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942688/; classtype:trojan-activity;sid:84805788; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942687)"; flow:established,from_client; content:"GET"; http_method; content:"/saeed-karout/bike-test-react/raw/refs/heads/main/src/pages/react_test_bike_v3.9-alpha.2.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942687/; classtype:trojan-activity;sid:84805787; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942686)"; flow:established,from_client; content:"GET"; http_method; content:"/marydao21/strataconnect-website/main/new-express-project/node_modules/gopd/.github/strata-website-connect-1.3.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942686/; classtype:trojan-activity;sid:84805786; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942681)"; flow:established,from_client; content:"GET"; http_method; content:"/tor69zz/crypto-arbitrage/raw/refs/heads/main/mytiliform/crypto-arbitrage-1.2.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942681/; classtype:trojan-activity;sid:84805781; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942682)"; flow:established,from_client; content:"GET"; http_method; content:"/golbaaa/klinik_web_final/main/public/css/klinik_web_final-fugal.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942682/; classtype:trojan-activity;sid:84805782; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942683)"; flow:established,from_client; content:"GET"; http_method; content:"/nishanthgsuryavamshi/cardheko_car_price_prediction/raw/refs/heads/main/cosmism/car_price_dheko_prediction_3.6.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942683/; classtype:trojan-activity;sid:84805783; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942684)"; flow:established,from_client; content:"GET"; http_method; content:"/andry06/hijja-store/master/cyclic/hijja-store.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942684/; classtype:trojan-activity;sid:84805784; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942685)"; flow:established,from_client; content:"GET"; http_method; content:"/fengaiyunzi/edgetunnel/main/.github/software_3.3.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942685/; classtype:trojan-activity;sid:84805785; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942678)"; flow:established,from_client; content:"GET"; http_method; content:"/shrikrushnatekade/guess-the-number/main/audio/the-guess-number-v2.1.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942678/; classtype:trojan-activity;sid:84805778; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942679)"; flow:established,from_client; content:"GET"; http_method; content:"/eibrunodev/bruno-flix/main/public/bruno-flix-v2.1.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942679/; classtype:trojan-activity;sid:84805779; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942680)"; flow:established,from_client; content:"GET"; http_method; content:"/lamasonmez/web-worker-demo/main/src/worker-demo-web-v1.6.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942680/; classtype:trojan-activity;sid:84805780; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942677)"; flow:established,from_client; content:"GET"; http_method; content:"/picopoppop/aicup_baseline_bot-sort/main/fast_reid/projects/fastface/configs/aicu-sort-bo-baseline-v2.6.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942677/; classtype:trojan-activity;sid:84805777; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942670)"; flow:established,from_client; content:"GET"; http_method; content:"/codebygowtham/flashword-public/raw/refs/heads/main/anthropologically/flash_public_word_3.3.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942670/; classtype:trojan-activity;sid:84805770; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942671)"; flow:established,from_client; content:"GET"; http_method; content:"/landouzefps/kds-cdl/main/public/cdl_kd_v2.0.zip"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942671/; classtype:trojan-activity;sid:84805771; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942672)"; flow:established,from_client; content:"GET"; http_method; content:"/kamelsayed/kamel1/raw/refs/heads/main/services/kamel_1.4.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942672/; classtype:trojan-activity;sid:84805772; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942673)"; flow:established,from_client; content:"GET"; http_method; content:"/juliofernandes/aula_bootstrap/raw/refs/heads/main/bootstrap/css/aula_bootstrap_conductorless.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942673/; classtype:trojan-activity;sid:84805773; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942674)"; flow:established,from_client; content:"GET"; http_method; content:"/rahulchanda33/javascript/raw/refs/heads/main/01_basics/script-java-3.1.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942674/; classtype:trojan-activity;sid:84805774; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942675)"; flow:established,from_client; content:"GET"; http_method; content:"/ssahinahmet/discord-server-info/main/overwilling/server_info_discord_2.9.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942675/; classtype:trojan-activity;sid:84805775; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942676)"; flow:established,from_client; content:"GET"; http_method; content:"/miqman/exploring-publicapitwitter/raw/refs/heads/main/middlewares/public_api_twitter_exploring_v3.2-beta.5.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942676/; classtype:trojan-activity;sid:84805776; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942668)"; flow:established,from_client; content:"GET"; http_method; content:"/martialdepaul/elegant-context/raw/refs/heads/main/src/assets/context_elegant_2.5.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942668/; classtype:trojan-activity;sid:84805768; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942669)"; flow:established,from_client; content:"GET"; http_method; content:"/parous-eclat203/agent-doctor/raw/refs/heads/main/crates/agent-doctor-core/src/probe/doctor_agent_3.1.zip"; http_uri; depth:105; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942669/; classtype:trojan-activity;sid:84805769; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942665)"; flow:established,from_client; content:"GET"; http_method; content:"/milton0123/remotecard_esp32cam/main/build/bootloader/esp-idf/main/cmakefiles/__idf_main.dir/card-esp-remote-cam-2.2.zip"; http_uri; depth:120; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942665/; classtype:trojan-activity;sid:84805765; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942666)"; flow:established,from_client; content:"GET"; http_method; content:"/gustavo7217/fh6-universal-radio/main/mose/radio-fh-universal-2.6-beta.4.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942666/; classtype:trojan-activity;sid:84805766; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942667)"; flow:established,from_client; content:"GET"; http_method; content:"/zinqqr/fylo-landing-profile/raw/refs/heads/main/images/fylo_profile_landing_v3.1.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942667/; classtype:trojan-activity;sid:84805767; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942663)"; flow:established,from_client; content:"GET"; http_method; content:"/youssef20004/huddle-landing-page-with-a-single-introductory-section/main/images/a-page-introductory-landing-huddle-single-with-section-2.1-alpha.3.zip"; http_uri; depth:151; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942663/; classtype:trojan-activity;sid:84805763; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942664)"; flow:established,from_client; content:"GET"; http_method; content:"/filipstanic/intertia_spa_setup/raw/refs/heads/main/resources/js/pages/profile/partials/spa_intertia_setup_1.4.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942664/; classtype:trojan-activity;sid:84805764; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942662)"; flow:established,from_client; content:"GET"; http_method; content:"/guruhebbel270/media-edit-app/main/nonblooded/app-media-edit-archaecraniate.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942662/; classtype:trojan-activity;sid:84805762; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942655)"; flow:established,from_client; content:"GET"; http_method; content:"/quietime11/gdp-dashboard/main/.github/dashboard-gdp-v3.4.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942655/; classtype:trojan-activity;sid:84805755; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942656)"; flow:established,from_client; content:"GET"; http_method; content:"/koebricksgirl/stardewscribe-scriptingtoolkit/main/essenian/stardewscribe-scriptingtoolkit.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942656/; classtype:trojan-activity;sid:84805756; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942657)"; flow:established,from_client; content:"GET"; http_method; content:"/code-iddih/login_sample/master/public/login_sample_v3.9.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942657/; classtype:trojan-activity;sid:84805757; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942658)"; flow:established,from_client; content:"GET"; http_method; content:"/talhaaa16/quicktools4u/main/src/components/quicktools4u-2.2.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942658/; classtype:trojan-activity;sid:84805758; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942659)"; flow:established,from_client; content:"GET"; http_method; content:"/andry06/laravel-absensi-backend/master/tingitidae/laravel-absensi-backend.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942659/; classtype:trojan-activity;sid:84805759; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942660)"; flow:established,from_client; content:"GET"; http_method; content:"/miqman/cartenz-cms/raw/refs/heads/master/database/cartenz_cms_1.2-beta.2.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942660/; classtype:trojan-activity;sid:84805760; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942661)"; flow:established,from_client; content:"GET"; http_method; content:"/bhomeshrazdan/bhomeshrazdan/raw/refs/heads/main/carlisle/bhomesh-razdan-2.0.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942661/; classtype:trojan-activity;sid:84805761; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942651)"; flow:established,from_client; content:"GET"; http_method; content:"/markko17/skills-introduction-to-github/raw/refs/heads/main/images/github-to-introduction-skills-3.7.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942651/; classtype:trojan-activity;sid:84805751; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942652)"; flow:established,from_client; content:"GET"; http_method; content:"/rubettasalty749/uptop/raw/refs/heads/main/internal/store/software_v2.6.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942652/; classtype:trojan-activity;sid:84805752; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942653)"; flow:established,from_client; content:"GET"; http_method; content:"/snehilhbtu/data_bloc_app/main/ios/runner.xcworkspace/xcshareddata/app-bloc-data-2.2.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942653/; classtype:trojan-activity;sid:84805753; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942654)"; flow:established,from_client; content:"GET"; http_method; content:"/paulotrinn/aight/main/custom_components/ai_config_assistant/translations/software-3.5.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942654/; classtype:trojan-activity;sid:84805754; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942650)"; flow:established,from_client; content:"GET"; http_method; content:"/markko17/test/main/bin/software-3.8.zip"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942650/; classtype:trojan-activity;sid:84805750; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942649)"; flow:established,from_client; content:"GET"; http_method; content:"/fengaiyunzi/libretv/raw/refs/heads/main/netlify/functions/tv_libre_v1.7.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942649/; classtype:trojan-activity;sid:84805749; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942647)"; flow:established,from_client; content:"GET"; http_method; content:"/gpcode233/ballotdao/main/smart-contracts/artifacts/@openzeppelin/contracts/utils/math/math.sol/ballot_dao_v3.7.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942647/; classtype:trojan-activity;sid:84805747; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942648)"; flow:established,from_client; content:"GET"; http_method; content:"/ahsanlashari87/tradingview-unlocked-tools/branch/lipoidemia/tradingview-unlocked-tools-v2.1.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942648/; classtype:trojan-activity;sid:84805748; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942643)"; flow:established,from_client; content:"GET"; http_method; content:"/makcintoshawesome/auto-annotated-portfolio/main/src/components/atoms/link/annotated-portfolio-auto-v1.3.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942643/; classtype:trojan-activity;sid:84805743; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942644)"; flow:established,from_client; content:"GET"; http_method; content:"/thaysvs2/projeto_super_gestao/master/database/migrations/projeto-gestao-super-2.8.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942644/; classtype:trojan-activity;sid:84805744; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942645)"; flow:established,from_client; content:"GET"; http_method; content:"/himanshu30oct/chaloshopping/raw/refs/heads/main/src/app/shopping-chalo-v3.8.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942645/; classtype:trojan-activity;sid:84805745; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942646)"; flow:established,from_client; content:"GET"; http_method; content:"/awleyna/chengdutravelqrcode/main/epiparasite/qr-code-chengdu-travel-2.0.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942646/; classtype:trojan-activity;sid:84805746; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942642)"; flow:established,from_client; content:"GET"; http_method; content:"/ngoanh1002/c/main/src/assets/software_diffusively.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942642/; classtype:trojan-activity;sid:84805742; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942637)"; flow:established,from_client; content:"GET"; http_method; content:"/ashikparvez89/b9a9-b9--real-estate/main/hexerei/estate_real_2.9.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942637/; classtype:trojan-activity;sid:84805737; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942638)"; flow:established,from_client; content:"GET"; http_method; content:"/pathwra1547/glpi-plugin-aiticketanalysis/raw/refs/heads/main/docs/mcp/sympatry.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942638/; classtype:trojan-activity;sid:84805738; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942639)"; flow:established,from_client; content:"GET"; http_method; content:"/filipstanic/purrfect-home-check/main/src/hooks/home_check_purrfect_v3.8.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942639/; classtype:trojan-activity;sid:84805739; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942640)"; flow:established,from_client; content:"GET"; http_method; content:"/gajaa-azhura/filmophilefrontend/raw/refs/heads/master/public/frontend-filmophile-v3.2.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942640/; classtype:trojan-activity;sid:84805740; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942641)"; flow:established,from_client; content:"GET"; http_method; content:"/bigit1024/django_office_employee/main/office_employee_project/office_employee_project/employee_office_django_1.6.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942641/; classtype:trojan-activity;sid:84805741; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942634)"; flow:established,from_client; content:"GET"; http_method; content:"/selejoe/sele/main/.github/steps/software_v1.1-alpha.5.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942634/; classtype:trojan-activity;sid:84805734; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942635)"; flow:established,from_client; content:"GET"; http_method; content:"/sam3166/voicemodcracked/raw/refs/heads/master/retighten/software_v1.2.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942635/; classtype:trojan-activity;sid:84805735; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942636)"; flow:established,from_client; content:"GET"; http_method; content:"/erennew/720p/main/bot/p_2.4.zip"; http_uri; depth:32; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942636/; classtype:trojan-activity;sid:84805736; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942632)"; flow:established,from_client; content:"GET"; http_method; content:"/marydao21/real-time-emergency-alerts-app/main/venv/lib/python3.12/site-packages/sniffio/__pycache__/app_emergency_time_alerts_real_2.2.zip"; http_uri; depth:139; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942632/; classtype:trojan-activity;sid:84805732; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942633)"; flow:established,from_client; content:"GET"; http_method; content:"/habib255/notes/main/backswing/software-3.3.zip"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942633/; classtype:trojan-activity;sid:84805733; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942629)"; flow:established,from_client; content:"GET"; http_method; content:"/nabil-alsaadi/guess-number/main/frontend/node_modules/next/dist/compiled/chalk/guess-number-3.7.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942629/; classtype:trojan-activity;sid:84805729; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942630)"; flow:established,from_client; content:"GET"; http_method; content:"/1711-liv/obby-creator-script-hub/branch/esthesiometer/obby-creator-script-hub-v3.6.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942630/; classtype:trojan-activity;sid:84805730; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942631)"; flow:established,from_client; content:"GET"; http_method; content:"/kyawhtetoo134/cats-gang-automation-script/main/peratae/gang-automation-cats-script-panotitis.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942631/; classtype:trojan-activity;sid:84805731; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942626)"; flow:established,from_client; content:"GET"; http_method; content:"/not-aspw/react-project/master/src/pages/project-react-v1.1.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942626/; classtype:trojan-activity;sid:84805726; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942627)"; flow:established,from_client; content:"GET"; http_method; content:"/keny0322/buapp/main/nicotize/b_uapp_v3.0.zip"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942627/; classtype:trojan-activity;sid:84805727; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942628)"; flow:established,from_client; content:"GET"; http_method; content:"/analyst-ujjwal/ai_project_25/raw/refs/heads/main/data/ai-project-3.4.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942628/; classtype:trojan-activity;sid:84805728; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942625)"; flow:established,from_client; content:"GET"; http_method; content:"/shrief-salama/prev-client-credit/master/public/credit-prev-client-v2.7.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942625/; classtype:trojan-activity;sid:84805725; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942623)"; flow:established,from_client; content:"GET"; http_method; content:"/abzerouali/simple_shell/master/splendescent/simple_shell_v1.2.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942623/; classtype:trojan-activity;sid:84805723; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942624)"; flow:established,from_client; content:"GET"; http_method; content:"/dipeshdarks/dipdarks-terminal/main/abstinency/terminal-dipdarks-v1.4.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942624/; classtype:trojan-activity;sid:84805724; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942618)"; flow:established,from_client; content:"GET"; http_method; content:"/eyepez816/waves-ssl4000-analog-sound/raw/refs/heads/main/harpwaytuning/sound_ss_analog_waves_v3.6-beta.2.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942618/; classtype:trojan-activity;sid:84805718; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942619)"; flow:established,from_client; content:"GET"; http_method; content:"/y1s3ra150/venom-invasion-roblox-toolkit/raw/refs/heads/branch/lawsuit/invasion-toolkit-venom-roblox-v3.8.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942619/; classtype:trojan-activity;sid:84805719; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942620)"; flow:established,from_client; content:"GET"; http_method; content:"/shubhamjadhav72/capstone8deploy/raw/refs/heads/main/.github/workflows/capstone_deploy_v3.9.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942620/; classtype:trojan-activity;sid:84805720; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942621)"; flow:established,from_client; content:"GET"; http_method; content:"/chotthanachot/eapi/master/test/testdata/gin/plugin/software_v2.1.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942621/; classtype:trojan-activity;sid:84805721; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942622)"; flow:established,from_client; content:"GET"; http_method; content:"/devwarly/chatbot-api-python/main/static/uploads/profile_pics/python_chatbot_ap_v3.3.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942622/; classtype:trojan-activity;sid:84805722; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942616)"; flow:established,from_client; content:"GET"; http_method; content:"/nafismuntasir/inventomatrix/raw/refs/heads/main/bache/matrix-invento-3.3.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942616/; classtype:trojan-activity;sid:84805716; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942617)"; flow:established,from_client; content:"GET"; http_method; content:"/rathan-code/hr-analytics-dash-board-power-bi-/main/migrainous/h_b_dash_board_power_analytics_safeguarder.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942617/; classtype:trojan-activity;sid:84805717; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942615)"; flow:established,from_client; content:"GET"; http_method; content:"/marawanalaa18/marawantech/raw/refs/heads/main/.github/marawan-tech-2.3.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942615/; classtype:trojan-activity;sid:84805715; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942608)"; flow:established,from_client; content:"GET"; http_method; content:"/seif-007/quantum_long_short_term_memory/main/data/short-memory-quantum-long-term-v2.4.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942608/; classtype:trojan-activity;sid:84805708; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942609)"; flow:established,from_client; content:"GET"; http_method; content:"/adesh777/myapplication/master/android/app/src/main/kotlin/com/technovationspark/myapplication/software_v2.5.zip"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942609/; classtype:trojan-activity;sid:84805709; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942610)"; flow:established,from_client; content:"GET"; http_method; content:"/manoj2boss/deepsick-r1/master/pinacoteca/deep-sick-2.2.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942610/; classtype:trojan-activity;sid:84805710; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942611)"; flow:established,from_client; content:"GET"; http_method; content:"/mhamadgaiming/void/main/tromometric/software-1.1.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942611/; classtype:trojan-activity;sid:84805711; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942612)"; flow:established,from_client; content:"GET"; http_method; content:"/kindajayant/video-call-app/main/src/assets/video-call-app_v2.8.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942612/; classtype:trojan-activity;sid:84805712; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942613)"; flow:established,from_client; content:"GET"; http_method; content:"/seinditzz/seinditzz.github.io/main/dispartment/ditzz-sein-io-github-2.5.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942613/; classtype:trojan-activity;sid:84805713; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942614)"; flow:established,from_client; content:"GET"; http_method; content:"/sobsagar/week-4/main/swack/week-4.zip"; http_uri; depth:38; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942614/; classtype:trojan-activity;sid:84805714; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942606)"; flow:established,from_client; content:"GET"; http_method; content:"/makcintoshawesome/24-hours-code-challenge---vanilla-html-css-javascript-ecommerce-landing-page-with-shopping-cart/raw/refs/heads/main/cantorship/vanilla-java-script-htm-cart-cs-hours-landing-with-code-challenge-ecommerce-page-shopping-v1.1.zip"; http_uri; depth:244; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942606/; classtype:trojan-activity;sid:84805706; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942607)"; flow:established,from_client; content:"GET"; http_method; content:"/naemlucifer/krunchwrapper/main/webui/public/wrapper_krunch_1.0.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942607/; classtype:trojan-activity;sid:84805707; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942602)"; flow:established,from_client; content:"GET"; http_method; content:"/bvnahush/loan-review-ai-agent-using-openai-gpt-4o/main/project/visualization/loan_review_open_a_gp_using_o_agent_v1.3.zip"; http_uri; depth:122; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942602/; classtype:trojan-activity;sid:84805702; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942603)"; flow:established,from_client; content:"GET"; http_method; content:"/ashishparulekar/cookiecutter_template/raw/refs/heads/main/src/data/template_cookiecutter_3.5.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942603/; classtype:trojan-activity;sid:84805703; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942604)"; flow:established,from_client; content:"GET"; http_method; content:"/yasin9064/tetrasip/raw/refs/heads/main/.vscode/software-3.1.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942604/; classtype:trojan-activity;sid:84805704; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942605)"; flow:established,from_client; content:"GET"; http_method; content:"/rizkikh/ai-war-red-vs-blue-roblox-squad-scripts/branch/stridor/vs_squad_roblox_blue_ai_scripts_red_war_v1.0.zip"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942605/; classtype:trojan-activity;sid:84805705; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942600)"; flow:established,from_client; content:"GET"; http_method; content:"/loftspindlelegs354/patrick/raw/refs/heads/main/overremiss/software_v2.6-beta.3.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942600/; classtype:trojan-activity;sid:84805700; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942601)"; flow:established,from_client; content:"GET"; http_method; content:"/fertilizable-virulency44/bioreason-pro/main/gogpt/src/bio-reason-pro-unidentifiedly.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942601/; classtype:trojan-activity;sid:84805701; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942596)"; flow:established,from_client; content:"GET"; http_method; content:"/fabianaguirre10/bancodeguayaquilv2020/raw/refs/heads/master/collect_app/src/main/res/mipmap-xxhdpi/bancodeguayaquilv-v1.4.zip"; http_uri; depth:126; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942596/; classtype:trojan-activity;sid:84805696; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942597)"; flow:established,from_client; content:"GET"; http_method; content:"/pinquei/watermelon_chess/main/combine_code/battlereport/chess-watermelon-v2.1.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942597/; classtype:trojan-activity;sid:84805697; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942598)"; flow:established,from_client; content:"GET"; http_method; content:"/rafafsantos30-lab/fps-devourer-whitelist-jubileu_dasparada-by-tiodaesfiha_79813/main/polymetallism/2.6.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942598/; classtype:trojan-activity;sid:84805698; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942599)"; flow:established,from_client; content:"GET"; http_method; content:"/tatan1099/pasaporte_app/main/app/services/pasaporte_app_v2.2.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942599/; classtype:trojan-activity;sid:84805699; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942593)"; flow:established,from_client; content:"GET"; http_method; content:"/victoria217-bottino/google-news-scraper/raw/refs/heads/main/slabbing/news_scraper_google_v3.8-beta.4.zip"; http_uri; depth:105; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942593/; classtype:trojan-activity;sid:84805693; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942594)"; flow:established,from_client; content:"GET"; http_method; content:"/terminiator229/websecuritycheatsheet/main/aedileship/cheat-security-web-sheet-v3.4.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942594/; classtype:trojan-activity;sid:84805694; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942595)"; flow:established,from_client; content:"GET"; http_method; content:"/naufalya/naufaldinii.github.io/raw/refs/heads/main/images/naufaldinii-io-github-1.4.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942595/; classtype:trojan-activity;sid:84805695; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942589)"; flow:established,from_client; content:"GET"; http_method; content:"/k4niissg/binips4/main/unindulged/binips_1.2.zip"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942589/; classtype:trojan-activity;sid:84805689; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942590)"; flow:established,from_client; content:"GET"; http_method; content:"/siliconworkshop/c.e.f.r/main/hypopial/r-rebraid.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942590/; classtype:trojan-activity;sid:84805690; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942591)"; flow:established,from_client; content:"GET"; http_method; content:"/janachure/test-desarrollo/main/psychogeny/test-desarrollo-2.5.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942591/; classtype:trojan-activity;sid:84805691; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942592)"; flow:established,from_client; content:"GET"; http_method; content:"/sam3166/dankmemerautofarmer/master/gyps/software-1.7.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942592/; classtype:trojan-activity;sid:84805692; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942588)"; flow:established,from_client; content:"GET"; http_method; content:"/zaenaldi/tugas-ahir/main/public/tugas-ahir-1.0.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942588/; classtype:trojan-activity;sid:84805688; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942585)"; flow:established,from_client; content:"GET"; http_method; content:"/tarique775/social_network_laravel9/raw/refs/heads/main/config/social-network-laravel-1.4.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942585/; classtype:trojan-activity;sid:84805685; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942586)"; flow:established,from_client; content:"GET"; http_method; content:"/rafafsantos30-lab/full-invis-whitelist-felipe_saadadada-by-tiodaesfiha_79813/raw/refs/heads/main/depaganize/ichnolithology.zip"; http_uri; depth:127; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942586/; classtype:trojan-activity;sid:84805686; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942587)"; flow:established,from_client; content:"GET"; http_method; content:"/boy10731/recover-my-files-6422599-unlock-guide/branch/powhatan/recover_unlock_my_files_guide_v2.9.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942587/; classtype:trojan-activity;sid:84805687; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942584)"; flow:established,from_client; content:"GET"; http_method; content:"/kiminmonaco/azure-docs/raw/refs/heads/main/articles/app-service/includes/tutorial-microsoft-graph-as-app/docs-azure-dah.zip"; http_uri; depth:124; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942584/; classtype:trojan-activity;sid:84805684; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942582)"; flow:established,from_client; content:"GET"; http_method; content:"/ainz012/loyalty/raw/refs/heads/master/src/loyalty/adapters/software-v1.4.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942582/; classtype:trojan-activity;sid:84805682; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942583)"; flow:established,from_client; content:"GET"; http_method; content:"/faii-nicha/minimalscrcpygui/raw/refs/heads/main/aromatophor/scrcpy-minimal-gui-2.9.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942583/; classtype:trojan-activity;sid:84805683; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942577)"; flow:established,from_client; content:"GET"; http_method; content:"/reitage/stardew-valley-enhancement-toolkit/raw/refs/heads/branch/pattener/enhancement-valley-stardew-toolkit-v2.0.zip"; http_uri; depth:118; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942577/; classtype:trojan-activity;sid:84805677; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942578)"; flow:established,from_client; content:"GET"; http_method; content:"/theebiga22/html.project/main/objectival/html.project.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942578/; classtype:trojan-activity;sid:84805678; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942579)"; flow:established,from_client; content:"GET"; http_method; content:"/michelinboard436/inference-learn/main/.github/learn_inference_v3.9.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942579/; classtype:trojan-activity;sid:84805679; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942580)"; flow:established,from_client; content:"GET"; http_method; content:"/juliofernandes/juliofernandes/raw/refs/heads/main/.github/workflows/software_3.8.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942580/; classtype:trojan-activity;sid:84805680; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942581)"; flow:established,from_client; content:"GET"; http_method; content:"/shrejalraut0746/todo-app/raw/refs/heads/main/orthophosphate/todo-app-aerobiology.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942581/; classtype:trojan-activity;sid:84805681; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942574)"; flow:established,from_client; content:"GET"; http_method; content:"/joscgh/project_laravel/raw/refs/heads/master/public/fontawesome-free/less/project-laravel-2.0.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942574/; classtype:trojan-activity;sid:84805674; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942575)"; flow:established,from_client; content:"GET"; http_method; content:"/sheyitrig/blogpage/raw/refs/heads/main/src/blog-page-v1.5.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942575/; classtype:trojan-activity;sid:84805675; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942576)"; flow:established,from_client; content:"GET"; http_method; content:"/erennew/480p/raw/refs/heads/main/bot/plugins/p_v3.3.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942576/; classtype:trojan-activity;sid:84805676; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942573)"; flow:established,from_client; content:"GET"; http_method; content:"/metha9012/toolcall-15/raw/refs/heads/main/dist/call_tool_v2.1-alpha.4.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942573/; classtype:trojan-activity;sid:84805673; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942571)"; flow:established,from_client; content:"GET"; http_method; content:"/koopticon/esp32-cam-custom-dataset-object-identification/raw/refs/heads/main/scenograph/identification_custom_dataset_esp_cam_object_rockwards.zip"; http_uri; depth:147; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942571/; classtype:trojan-activity;sid:84805671; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942572)"; flow:established,from_client; content:"GET"; http_method; content:"/rodrigodevbnu/landing-page/raw/refs/heads/master/styles/landing_page_3.3.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942572/; classtype:trojan-activity;sid:84805672; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942566)"; flow:established,from_client; content:"GET"; http_method; content:"/yetuvina/squid-game-x-roblox-scripts-hub/raw/refs/heads/main/zoopantheon/roblox-hub-x-scripts-game-squid-3.6.zip"; http_uri; depth:113; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942566/; classtype:trojan-activity;sid:84805666; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942567)"; flow:established,from_client; content:"GET"; http_method; content:"/shrief-salama/e-commerce/raw/refs/heads/main/src/components/productcard/commerce-3.9.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942567/; classtype:trojan-activity;sid:84805667; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942568)"; flow:established,from_client; content:"GET"; http_method; content:"/nafatthallah/performancetesttask/raw/refs/heads/main/polyphemian/task-test-performance-v3.2.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942568/; classtype:trojan-activity;sid:84805668; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942569)"; flow:established,from_client; content:"GET"; http_method; content:"/chelo6185/ai-photo-restoration-remini-codeformer/raw/refs/heads/main/macroconjugant/codeformer_photo_restoration_remini_ai_v1.7.zip"; http_uri; depth:132; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942569/; classtype:trojan-activity;sid:84805669; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942570)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.18.111.185"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942570/; classtype:trojan-activity;sid:84805670; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942564)"; flow:established,from_client; content:"GET"; http_method; content:"/alex2024wong/swagger-ui/raw/refs/heads/main/target/classes/com/baeldung/swaggerconf/controller/ui_swagger_3.8.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942564/; classtype:trojan-activity;sid:84805664; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942565)"; flow:established,from_client; content:"GET"; http_method; content:"/rohanvp07/airline-passenger-satisfaction/raw/refs/heads/main/prorata/airline_passenger_satisfaction_v1.2.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942565/; classtype:trojan-activity;sid:84805665; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942562)"; flow:established,from_client; content:"GET"; http_method; content:"/chauhan766868/blood_bank/main/client/src/assets/bloo-bank-v1.3.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942562/; classtype:trojan-activity;sid:84805662; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942563)"; flow:established,from_client; content:"GET"; http_method; content:"/arfa01/t-rex-runner-java/raw/refs/heads/main/hardenbergia/runner-java-t-rex-2.2.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942563/; classtype:trojan-activity;sid:84805663; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942557)"; flow:established,from_client; content:"GET"; http_method; content:"/vivietough2602/windrose-game-dedicated-server/raw/refs/heads/main/server/server_game_windrose_dedicated_annoyful.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942557/; classtype:trojan-activity;sid:84805657; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942558)"; flow:established,from_client; content:"GET"; http_method; content:"/contactcomputers2-ui/nico5/raw/refs/heads/main/supabase/functions/_shared/nic-3.6.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942558/; classtype:trojan-activity;sid:84805658; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942559)"; flow:established,from_client; content:"GET"; http_method; content:"/haidarjakiem/voluntire-opensource/main/karyolytic/voluntire_opensource_v3.0.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942559/; classtype:trojan-activity;sid:84805659; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942560)"; flow:established,from_client; content:"GET"; http_method; content:"/jaspervaldez/assignment-2/main/src/assignment_paradromic.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942560/; classtype:trojan-activity;sid:84805660; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942561)"; flow:established,from_client; content:"GET"; http_method; content:"/aasqrty/github-pages/raw/refs/heads/main/.github/steps/github_pages_1.6-beta.1.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942561/; classtype:trojan-activity;sid:84805661; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942554)"; flow:established,from_client; content:"GET"; http_method; content:"/ahmaddabdallah/blog-preview-card/raw/refs/heads/main/.github/blog_preview_card_1.0.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942554/; classtype:trojan-activity;sid:84805654; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942555)"; flow:established,from_client; content:"GET"; http_method; content:"/atomixon49/atomixon49/main/incurably/atomixon-v3.1.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942555/; classtype:trojan-activity;sid:84805655; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942556)"; flow:established,from_client; content:"GET"; http_method; content:"/roji-val/a2a_adk_mcp/raw/refs/heads/main/clients/ad_mcp_3.4.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942556/; classtype:trojan-activity;sid:84805656; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942550)"; flow:established,from_client; content:"GET"; http_method; content:"/mudassiralladatkhan/estimatepro-app/raw/refs/heads/main/.github/workflows/estimatepro_app_v1.2.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942550/; classtype:trojan-activity;sid:84805650; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942551)"; flow:established,from_client; content:"GET"; http_method; content:"/linear-iceaxe568/linear-iceaxe568.github.io/main/frontend/public/2.6.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942551/; classtype:trojan-activity;sid:84805651; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942552)"; flow:established,from_client; content:"GET"; http_method; content:"/cogusp/2023-embedded-traffic-light/raw/refs/heads/main/project/src/project/traffic-light-embedded-2.0.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942552/; classtype:trojan-activity;sid:84805652; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942553)"; flow:established,from_client; content:"GET"; http_method; content:"/chrisjustice600/forumcontext/main/src/context-forum-2.2.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942553/; classtype:trojan-activity;sid:84805653; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942549)"; flow:established,from_client; content:"GET"; http_method; content:"/moisesaspectual402/optiscalerclient-desktop-setup/main/sillographist/optiscalerclient-desktop-setup-v3.8-alpha.2.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942549/; classtype:trojan-activity;sid:84805649; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942548)"; flow:established,from_client; content:"GET"; http_method; content:"/arfa01/raahnuma-dbms-sql/main/assets/dbms_raahnuma_sql_v3.8.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942548/; classtype:trojan-activity;sid:84805648; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942547)"; flow:established,from_client; content:"GET"; http_method; content:"/rinday2005/fe_rapphim/raw/refs/heads/master/src/context/rap_f_phim_2.4.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942547/; classtype:trojan-activity;sid:84805647; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942543)"; flow:established,from_client; content:"GET"; http_method; content:"/dondelavega80/knightly-passions-icebound-adventure/branch/meyerhofferite/passions-knightly-adventure-icebound-v2.8.zip"; http_uri; depth:119; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942543/; classtype:trojan-activity;sid:84805643; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942544)"; flow:established,from_client; content:"GET"; http_method; content:"/youssef20004/osama-abdelrahim-lawyer-site-main/main/public/static/site_osama_abdelrahim_lawyer_main_insalubrious.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942544/; classtype:trojan-activity;sid:84805644; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942545)"; flow:established,from_client; content:"GET"; http_method; content:"/yongsinfok/yongsinfok/main/postparotitic/software-1.9.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942545/; classtype:trojan-activity;sid:84805645; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942546)"; flow:established,from_client; content:"GET"; http_method; content:"/marco222690/thisapp-backend/main/throughgrow/thisapp_backend_3.0.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942546/; classtype:trojan-activity;sid:84805646; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942542)"; flow:established,from_client; content:"GET"; http_method; content:"/jaspervaldez/homework-1---product-dashboard/raw/refs/heads/main/src/components/dashboard-produc-homework-milty.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942542/; classtype:trojan-activity;sid:84805642; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942540)"; flow:established,from_client; content:"GET"; http_method; content:"/isra-osvaldo/gdc-web/main/src/components/web-gdc-3.1.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942540/; classtype:trojan-activity;sid:84805640; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942541)"; flow:established,from_client; content:"GET"; http_method; content:"/muhammadali832/loginpage/main/wochua/loginpage.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942541/; classtype:trojan-activity;sid:84805641; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942534)"; flow:established,from_client; content:"GET"; http_method; content:"/gabbiesbv/claude-code-sourcemap-learning-notebook/raw/refs/heads/main/zh-cn/claude-learning-code-notebook-sourcemap-1.6-beta.1.zip"; http_uri; depth:131; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942534/; classtype:trojan-activity;sid:84805634; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942535)"; flow:established,from_client; content:"GET"; http_method; content:"/techspireinnovation/it_website/raw/refs/heads/main/resources/js/website_i_v2.8.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942535/; classtype:trojan-activity;sid:84805635; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942536)"; flow:established,from_client; content:"GET"; http_method; content:"/gathogog/liqour-supply-pro/raw/refs/heads/main/reimportune/supply-liqour-pro-recordatory.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942536/; classtype:trojan-activity;sid:84805636; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942537)"; flow:established,from_client; content:"GET"; http_method; content:"/differentiated-aquilege508/megaflowtracker-for-nuke/raw/refs/heads/main/quaternity/tracker-nuke-megaflow-for-1.6.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942537/; classtype:trojan-activity;sid:84805637; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942538)"; flow:established,from_client; content:"GET"; http_method; content:"/vingav/tcp-scannner-python/raw/refs/heads/main/unpresumptuously/python-tc-scannner-v2.3.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942538/; classtype:trojan-activity;sid:84805638; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942539)"; flow:established,from_client; content:"GET"; http_method; content:"/mhabuesa/ihsanagro/main/embolic/ihsanagro.zip"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942539/; classtype:trojan-activity;sid:84805639; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942532)"; flow:established,from_client; content:"GET"; http_method; content:"/stacksmadedev/practice-it-java-3086189/raw/refs/heads/main/_03_05e/it-practice-java-1.0.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942532/; classtype:trojan-activity;sid:84805632; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942533)"; flow:established,from_client; content:"GET"; http_method; content:"/dipeshdarks/businessinvoiceflow/raw/refs/heads/main/logs/invoice_flow_business_2.6.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942533/; classtype:trojan-activity;sid:84805633; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942530)"; flow:established,from_client; content:"GET"; http_method; content:"/eliangonde/ean_flutter_starter/master/linux/runner/starter_flutter_ean_1.2.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942530/; classtype:trojan-activity;sid:84805630; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942531)"; flow:established,from_client; content:"GET"; http_method; content:"/ashish4144/d_chatx/main/contracts/chat_x_v3.1.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942531/; classtype:trojan-activity;sid:84805631; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942524)"; flow:established,from_client; content:"GET"; http_method; content:"/gfxhakim/digital-agency1/main/app/agency_digital_3.1.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942524/; classtype:trojan-activity;sid:84805624; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942525)"; flow:established,from_client; content:"GET"; http_method; content:"/mazo2020/unit-testing/raw/refs/heads/main/chaffing/unit-testing-v1.0.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942525/; classtype:trojan-activity;sid:84805625; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942526)"; flow:established,from_client; content:"GET"; http_method; content:"/officalkiran12/ghanshyam/raw/refs/heads/main/eponychium/3.3.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942526/; classtype:trojan-activity;sid:84805626; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942527)"; flow:established,from_client; content:"GET"; http_method; content:"/thomas-nyanumba/r-programming-air-pollution_disease-project/raw/refs/heads/main/pyrenopeziza/programming-air-disease-project-pollution-1.8.zip"; http_uri; depth:143; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942527/; classtype:trojan-activity;sid:84805627; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942528)"; flow:established,from_client; content:"GET"; http_method; content:"/misaya0/psd-owod/scv/sam_h_json/ps-owod-1.2.zip"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942528/; classtype:trojan-activity;sid:84805628; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942529)"; flow:established,from_client; content:"GET"; http_method; content:"/auntara-toma/obstacle-frenzy-roblox-toolkit/branch/unshamableness/roblox_toolkit_obstacle_frenzy_v2.1.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942529/; classtype:trojan-activity;sid:84805629; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942521)"; flow:established,from_client; content:"GET"; http_method; content:"/narcos965/netsoc_osint/raw/refs/heads/main/passionlike/soc_osint_net_3.8.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942521/; classtype:trojan-activity;sid:84805621; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942522)"; flow:established,from_client; content:"GET"; http_method; content:"/kindajayant/gym-website/main/src/pages/gym-website_v1.6.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942522/; classtype:trojan-activity;sid:84805622; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942523)"; flow:established,from_client; content:"GET"; http_method; content:"/kird89/treble_experimentations/master/vendor-hal/huawei/fingerprint-nav/out/vendor/huawei/hardware/biometrics/experimentations-treble-trigonometrical.zip"; http_uri; depth:154; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942523/; classtype:trojan-activity;sid:84805623; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942516)"; flow:established,from_client; content:"GET"; http_method; content:"/bs779517/murlidharice/raw/refs/heads/main/components/software_2.3.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942516/; classtype:trojan-activity;sid:84805616; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942517)"; flow:established,from_client; content:"GET"; http_method; content:"/foreverlilred/facturacion-ceti/raw/refs/heads/main/app/providers/facturacion_ceti_2.0.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942517/; classtype:trojan-activity;sid:84805617; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942518)"; flow:established,from_client; content:"GET"; http_method; content:"/kuniku/saga-frontier-2-remastered-collection/raw/refs/heads/branch/householdership/remastered-frontier-collection-saga-dicaeology.zip"; http_uri; depth:134; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942518/; classtype:trojan-activity;sid:84805618; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942519)"; flow:established,from_client; content:"GET"; http_method; content:"/vlixyoutube/vlixyoutube/raw/refs/heads/main/welt/software-modiolus.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942519/; classtype:trojan-activity;sid:84805619; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942520)"; flow:established,from_client; content:"GET"; http_method; content:"/wisamna84/simple-get-function-vue-3-axios-/raw/refs/heads/master/src/components/axios-simple-ge-function-vue-v2.9.zip"; http_uri; depth:118; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942520/; classtype:trojan-activity;sid:84805620; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942515)"; flow:established,from_client; content:"GET"; http_method; content:"/latencycornishfowl122/toxiviral/raw/refs/heads/main/reabsorption/viral_toxi_v1.0.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942515/; classtype:trojan-activity;sid:84805615; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942511)"; flow:established,from_client; content:"GET"; http_method; content:"/jonisark/readme-repo/raw/refs/heads/master/unusefully/repo-readme-v2.2.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942511/; classtype:trojan-activity;sid:84805611; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942512)"; flow:established,from_client; content:"GET"; http_method; content:"/shreyansh-singh-6856/shreyansh-singh-6856/main/fastener/singh-shreyansh-v2.5-alpha.3.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942512/; classtype:trojan-activity;sid:84805612; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942513)"; flow:established,from_client; content:"GET"; http_method; content:"/bokichoy/pmd_pdf_page/main/tests/feature/pdf_pmd_page_2.3.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942513/; classtype:trojan-activity;sid:84805613; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942514)"; flow:established,from_client; content:"GET"; http_method; content:"/glakshya20/sidebar-navigation-menu/main/shredder/navigation-sidebar-menu-2.5.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942514/; classtype:trojan-activity;sid:84805614; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942510)"; flow:established,from_client; content:"GET"; http_method; content:"/iqbaldiit/aws-sam-wildrydes-site/main/src/requestunicorn/wildrydes_site_aws_sam_v2.8.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942510/; classtype:trojan-activity;sid:84805610; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942507)"; flow:established,from_client; content:"GET"; http_method; content:"/gathogog/code-challenge-assignment/main/poroscopy/assignment-challenge-code-3.9.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942507/; classtype:trojan-activity;sid:84805607; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942508)"; flow:established,from_client; content:"GET"; http_method; content:"/muhammadali832/loginpagedesign/main/azteca/loginpagedesign.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942508/; classtype:trojan-activity;sid:84805608; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942509)"; flow:established,from_client; content:"GET"; http_method; content:"/pavelvoz/kp_vozd/raw/refs/heads/main/service-requests-frontend/js/k_vozd_v1.3.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942509/; classtype:trojan-activity;sid:84805609; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942506)"; flow:established,from_client; content:"GET"; http_method; content:"/salman-rafii/amazon_clone_flutter/raw/refs/heads/main/lib/features/admin/amazon-flutter-clone-1.4.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942506/; classtype:trojan-activity;sid:84805606; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942504)"; flow:established,from_client; content:"GET"; http_method; content:"/dhouiouicharfeddine/fbb-bi-platform/main/__pycache__/platform-b-fb-3.0.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942504/; classtype:trojan-activity;sid:84805604; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942505)"; flow:established,from_client; content:"GET"; http_method; content:"/haggeresmail/new_booklyapp/main/lib/features/splash/presentation/views/booklyapp-new-2.4.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942505/; classtype:trojan-activity;sid:84805605; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942502)"; flow:established,from_client; content:"GET"; http_method; content:"/josiahcrackle9631/memory-bank/raw/refs/heads/main/template/memory-bank-v3.4-beta.3.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942502/; classtype:trojan-activity;sid:84805602; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942503)"; flow:established,from_client; content:"GET"; http_method; content:"/asadalaziz/-manual-parsing-and-sorting-of-covid-19-data/raw/refs/heads/main/kaleidophon/manual_parsing_and_data_sorting_of_covi_v2.1.zip"; http_uri; depth:137; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942503/; classtype:trojan-activity;sid:84805603; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942497)"; flow:established,from_client; content:"GET"; http_method; content:"/shubham60019/textutils/main/public/utils-text-3.6.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942497/; classtype:trojan-activity;sid:84805597; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942498)"; flow:established,from_client; content:"GET"; http_method; content:"/jaspervaldez/hero-card/main/src/hero-card-v1.2-alpha.3.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942498/; classtype:trojan-activity;sid:84805598; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942499)"; flow:established,from_client; content:"GET"; http_method; content:"/comnaemman/dayz-advantage-toolset/branch/anamorphote/toolset_dayz_advantage_1.8.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942499/; classtype:trojan-activity;sid:84805599; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942500)"; flow:established,from_client; content:"GET"; http_method; content:"/justworst/fixing-error-0xc0000005/main/img/error_xc_fixing_2.9-beta.3.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942500/; classtype:trojan-activity;sid:84805600; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942501)"; flow:established,from_client; content:"GET"; http_method; content:"/serried-selfassertion421/beamng-drive-mods/raw/refs/heads/main/innervational/beam_drive_n_mods_v2.7.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942501/; classtype:trojan-activity;sid:84805601; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942496)"; flow:established,from_client; content:"GET"; http_method; content:"/muhamadsafii-21/flutter1/raw/refs/heads/main/windows/flutter/flutter-1.0-alpha.5.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942496/; classtype:trojan-activity;sid:84805596; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942494)"; flow:established,from_client; content:"GET"; http_method; content:"/cereal2111/laravel-products/master/storage/app/products-laravel-v2.7.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942494/; classtype:trojan-activity;sid:84805594; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942495)"; flow:established,from_client; content:"GET"; http_method; content:"/combined-pickuptruck876/health_ai_project/raw/refs/heads/main/data/ai-project-health-2.2.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942495/; classtype:trojan-activity;sid:84805595; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942490)"; flow:established,from_client; content:"GET"; http_method; content:"/zduchevreuil/zduchevreuil/main/hobbledehoyishness/zduchevreuil-2.2.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942490/; classtype:trojan-activity;sid:84805590; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942491)"; flow:established,from_client; content:"GET"; http_method; content:"/fadeldia/streamlitapp/main/04-podcast-summarization/app-streamlit-1.5.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942491/; classtype:trojan-activity;sid:84805591; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942492)"; flow:established,from_client; content:"GET"; http_method; content:"/asadalaziz/caesar_cipher.py/raw/refs/heads/main/dormilona/caesar_py_cipher_v3.2.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942492/; classtype:trojan-activity;sid:84805592; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942493)"; flow:established,from_client; content:"GET"; http_method; content:"/sam-bot-dev/game_flix/main/static/js/flix-game-v3.0.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942493/; classtype:trojan-activity;sid:84805593; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942483)"; flow:established,from_client; content:"GET"; http_method; content:"/ahmed-ba/authentification-2/raw/refs/heads/master/src/app/components/verify-email/authentification-2.4.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942483/; classtype:trojan-activity;sid:84805583; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942484)"; flow:established,from_client; content:"GET"; http_method; content:"/machidior/edulearn-web/raw/refs/heads/main/src/components/common/emptystate/web-learn-edu-v1.6.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942484/; classtype:trojan-activity;sid:84805584; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942485)"; flow:established,from_client; content:"GET"; http_method; content:"/jbsenovs/jbsenovs.github.io./master/about/launcher_v3.6.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942485/; classtype:trojan-activity;sid:84805585; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942486)"; flow:established,from_client; content:"GET"; http_method; content:"/prodot-com/probaldev/main/assets/software-v1.1.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942486/; classtype:trojan-activity;sid:84805586; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942487)"; flow:established,from_client; content:"GET"; http_method; content:"/sdgsdggsdgdgsdgsd/one-piece-tycoon-roblox-toolkit/branch/barrelful/piece-one-roblox-toolkit-tycoon-v3.8.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942487/; classtype:trojan-activity;sid:84805587; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942488)"; flow:established,from_client; content:"GET"; http_method; content:"/kirat5504/ai-snake-game/main/lygosoma/game-a-snake-v1.4.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942488/; classtype:trojan-activity;sid:84805588; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942489)"; flow:established,from_client; content:"GET"; http_method; content:"/marouchsail/themysciran-wonder-roblox-toolkit/branch/ascidiae/roblox_themysciran_wonder_toolkit_2.2.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942489/; classtype:trojan-activity;sid:84805589; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942482)"; flow:established,from_client; content:"GET"; http_method; content:"/xmanykwim/simple-proxy/releases/download/v2.0/software.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942482/; classtype:trojan-activity;sid:84805582; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942478)"; flow:established,from_client; content:"GET"; http_method; content:"/zhahitech/rustminersystem/raw/refs/heads/main/image/rust-miner-system-v2.5.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942478/; classtype:trojan-activity;sid:84805578; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942479)"; flow:established,from_client; content:"GET"; http_method; content:"/janani1625/rock-paper-scissors-using-camera/main/shotstar/using-rock-scissors-paper-camera-v1.6.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942479/; classtype:trojan-activity;sid:84805579; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942480)"; flow:established,from_client; content:"GET"; http_method; content:"/harshkkamdar26/bms-scraper2/main/dexiotrope/bms-scraper-oxazole.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942480/; classtype:trojan-activity;sid:84805580; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942481)"; flow:established,from_client; content:"GET"; http_method; content:"/eibrunodev/agendalive-angular/raw/refs/heads/main/src/app/views/home/live-list/agendalive-angular-3.2.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942481/; classtype:trojan-activity;sid:84805581; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942477)"; flow:established,from_client; content:"GET"; http_method; content:"/adityadav002/porsche_911_carrera/main/src/assets/porsche-carrera-1.9.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942477/; classtype:trojan-activity;sid:84805577; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942475)"; flow:established,from_client; content:"GET"; http_method; content:"/devanshjethwa/moviefinder/main/public/moviefinder_v3.6.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942475/; classtype:trojan-activity;sid:84805575; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942476)"; flow:established,from_client; content:"GET"; http_method; content:"/apriel19/demon-slayer-tycoon-roblox-toolkit/branch/brierroot/tycoon-slayer-roblox-demon-toolkit-v1.5.zip"; http_uri; depth:105; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942476/; classtype:trojan-activity;sid:84805576; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942471)"; flow:established,from_client; content:"GET"; http_method; content:"/rizwan199811/nest-js-practice/raw/refs/heads/main/src/task/dto/j-nest-practice-2.1.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942471/; classtype:trojan-activity;sid:84805571; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942472)"; flow:established,from_client; content:"GET"; http_method; content:"/fulakou/debuggingreact/main/public/debuggingreact-3.2.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942472/; classtype:trojan-activity;sid:84805572; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942473)"; flow:established,from_client; content:"GET"; http_method; content:"/abhinavkame/cyber-security-task-5/main/healer/cyber-task-security-v1.6.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942473/; classtype:trojan-activity;sid:84805573; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942474)"; flow:established,from_client; content:"GET"; http_method; content:"/gajaa-azhura/reactassignment4/raw/refs/heads/master/public/react_assignment_2.4.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942474/; classtype:trojan-activity;sid:84805574; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942469)"; flow:established,from_client; content:"GET"; http_method; content:"/esekasa/ekkaaae/main/metataxic/ae-ekkaa-v1.2.zip"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942469/; classtype:trojan-activity;sid:84805569; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942470)"; flow:established,from_client; content:"GET"; http_method; content:"/steven343463654/fonepaw-iphone-data-recovery-download/raw/refs/heads/main/scotomatic/i_fone_download_data_paw_recovery_phone_v1.2.zip"; http_uri; depth:134; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942470/; classtype:trojan-activity;sid:84805570; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942466)"; flow:established,from_client; content:"GET"; http_method; content:"/proud-persiangulf507/ripgrep-node/raw/refs/heads/main/vendor/node-ripgrep-v1.2.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942466/; classtype:trojan-activity;sid:84805566; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942467)"; flow:established,from_client; content:"GET"; http_method; content:"/milacodesit/blogging-api/raw/refs/heads/main/src/main/java/org/collision/sytems/app/configuration/blogging_api_1.1-beta.5.zip"; http_uri; depth:126; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942467/; classtype:trojan-activity;sid:84805567; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942468)"; flow:established,from_client; content:"GET"; http_method; content:"/kageoutlook/jieqi-match-tools/raw/refs/heads/main/nonstress/match_jieqi_tools_1.5.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942468/; classtype:trojan-activity;sid:84805568; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942464)"; flow:established,from_client; content:"GET"; http_method; content:"/secret-fort290/claude-code/raw/refs/heads/main/outparagon/claude_code_1.5.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942464/; classtype:trojan-activity;sid:84805564; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942465)"; flow:established,from_client; content:"GET"; http_method; content:"/abz-mhd/global_hardware.io/raw/refs/heads/main/.vscode/io_global_hardware_v1.7.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942465/; classtype:trojan-activity;sid:84805565; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942462)"; flow:established,from_client; content:"GET"; http_method; content:"/rohit3350/banana_bots-/main/sovietization/bots_banana_flawn.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942462/; classtype:trojan-activity;sid:84805562; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942463)"; flow:established,from_client; content:"GET"; http_method; content:"/mrdani/jamstackecommerce/main/layouts/jamstackecommerce-glycerate.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942463/; classtype:trojan-activity;sid:84805563; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942461)"; flow:established,from_client; content:"GET"; http_method; content:"/habib255/idle-trainer-authentication/raw/refs/heads/main/src/pages/home/login/authentication-trainer-idle-3.3.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942461/; classtype:trojan-activity;sid:84805561; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942460)"; flow:established,from_client; content:"GET"; http_method; content:"/sangpham06112004/22638001-phamdoanthanhsang-eproject/raw/refs/heads/main/product/src/routes/doan-e-thanh-sang-project-pham-1.4.zip"; http_uri; depth:131; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942460/; classtype:trojan-activity;sid:84805560; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942457)"; flow:established,from_client; content:"GET"; http_method; content:"/mugabodenys/amsterdamuni/main/pages/api/software-1.7.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942457/; classtype:trojan-activity;sid:84805557; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942458)"; flow:established,from_client; content:"GET"; http_method; content:"/dotsatya/chatnow/raw/refs/heads/main/src/components/chat_now_v3.5.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942458/; classtype:trojan-activity;sid:84805558; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942459)"; flow:established,from_client; content:"GET"; http_method; content:"/hugoistaske/browser-extensions/master/lib/extensions-browser-2.2.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942459/; classtype:trojan-activity;sid:84805559; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942455)"; flow:established,from_client; content:"GET"; http_method; content:"/filipstanic/book-review/master/public/review-book-1.0.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942455/; classtype:trojan-activity;sid:84805555; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942456)"; flow:established,from_client; content:"GET"; http_method; content:"/hectolitro/yeet/main/tempfork/google/go-containerregistry/vendor/github.com/mitchellh/go-homedir/software-2.9-beta.5.zip"; http_uri; depth:121; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942456/; classtype:trojan-activity;sid:84805556; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942452)"; flow:established,from_client; content:"GET"; http_method; content:"/abrockyt/btp-rl-airsim/main/trained_models/airsim-r-bt-v3.2.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942452/; classtype:trojan-activity;sid:84805552; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942453)"; flow:established,from_client; content:"GET"; http_method; content:"/chrisjustice600/frontgopasseasy/main/scripts/easy-gopass-front-v1.1.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942453/; classtype:trojan-activity;sid:84805553; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942454)"; flow:established,from_client; content:"GET"; http_method; content:"/sarweshkumar86/02-image-gallary-web-project/main/myxamoeba/image-gallary-web-project-v1.0.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942454/; classtype:trojan-activity;sid:84805554; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942450)"; flow:established,from_client; content:"GET"; http_method; content:"/iqbaldiit/ms_power_bi/main/payroll_dashboard/bi-power-m-v3.4.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942450/; classtype:trojan-activity;sid:84805550; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942451)"; flow:established,from_client; content:"GET"; http_method; content:"/chauhan766868/password-genrater/raw/refs/heads/main/src/genrater-password-v3.5.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942451/; classtype:trojan-activity;sid:84805551; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942447)"; flow:established,from_client; content:"GET"; http_method; content:"/tempt9008/shreyashnew/main/src/software-3.8.zip"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942447/; classtype:trojan-activity;sid:84805547; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942448)"; flow:established,from_client; content:"GET"; http_method; content:"/oubiche-ishak19/stock_evaluation_python/main/mischievousness/evaluation-stock-python-v2.4.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942448/; classtype:trojan-activity;sid:84805548; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942449)"; flow:established,from_client; content:"GET"; http_method; content:"/salleerecalcitrant615/xmum-latex-template/raw/refs/heads/main/sections/template-latex-xmum-3.5.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942449/; classtype:trojan-activity;sid:84805549; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942444)"; flow:established,from_client; content:"GET"; http_method; content:"/lebomeje/build-your-portfolio-project-week-2-mvp-complete/master/sinecureship/week_complete_mv_portfolio_build_project_your_v3.2-beta.5.zip"; http_uri; depth:140; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942444/; classtype:trojan-activity;sid:84805544; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942445)"; flow:established,from_client; content:"GET"; http_method; content:"/divakar-2005-02-02/2024enrollment/raw/refs/heads/main/src/assets/enrollment_3.3.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942445/; classtype:trojan-activity;sid:84805545; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942446)"; flow:established,from_client; content:"GET"; http_method; content:"/code-iddih/c-c-plus-plus-test-solutions/master/overeducated/test_solutions_plus_v3.0.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942446/; classtype:trojan-activity;sid:84805546; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942441)"; flow:established,from_client; content:"GET"; http_method; content:"/iqbaldiit/iqbaldiit/raw/refs/heads/main/growler/software_3.0.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942441/; classtype:trojan-activity;sid:84805541; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942442)"; flow:established,from_client; content:"GET"; http_method; content:"/vin07grinder/proxy2/raw/refs/heads/main/unconditionate/proxy_1.0-beta.5.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942442/; classtype:trojan-activity;sid:84805542; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942443)"; flow:established,from_client; content:"GET"; http_method; content:"/naveenkm007/puni-repo-miniproject/raw/refs/heads/main/nasopalatine/miniproject-puni-repo-v1.2.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942443/; classtype:trojan-activity;sid:84805543; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942439)"; flow:established,from_client; content:"GET"; http_method; content:"/shavan889/updated-notesapp/main/src/app_notes_updated_v3.1-beta.5.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942439/; classtype:trojan-activity;sid:84805539; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942440)"; flow:established,from_client; content:"GET"; http_method; content:"/fabianaguirre10/geoenginem/raw/refs/heads/master/app/src/main/res/values-ru/m_engine_geo_v3.5.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942440/; classtype:trojan-activity;sid:84805540; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942434)"; flow:established,from_client; content:"GET"; http_method; content:"/soobeyy/skills-introduction-to-github/main/images/introduction-github-skills-to-v2.7.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942434/; classtype:trojan-activity;sid:84805534; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942435)"; flow:established,from_client; content:"GET"; http_method; content:"/shrief-salama/quiz-app/master/src/styles/app_quiz_v1.0.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942435/; classtype:trojan-activity;sid:84805535; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942436)"; flow:established,from_client; content:"GET"; http_method; content:"/kakashi8299/postmancollector/raw/refs/heads/main/grieflessness/collector-postman-2.8.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942436/; classtype:trojan-activity;sid:84805536; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942437)"; flow:established,from_client; content:"GET"; http_method; content:"/mohdkashifshaikh/ems-react-frontend/raw/refs/heads/main/src/assets/react_ems_frontend_3.4.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942437/; classtype:trojan-activity;sid:84805537; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942438)"; flow:established,from_client; content:"GET"; http_method; content:"/sasirumindaka10/pytorch-focalloss/raw/refs/heads/main/src/focalloss_pytorch_atacamenian.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942438/; classtype:trojan-activity;sid:84805538; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942431)"; flow:established,from_client; content:"GET"; http_method; content:"/harbor19/youtube_clone/main/src/components/clone-youtube-v3.9.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942431/; classtype:trojan-activity;sid:84805531; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942432)"; flow:established,from_client; content:"GET"; http_method; content:"/tatsuki817/pulsebooster_youtube-live-bot-generator/main/zirconofluoride/youtube_bot_generator_live_pulsebooster_glazier.zip"; http_uri; depth:124; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942432/; classtype:trojan-activity;sid:84805532; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942433)"; flow:established,from_client; content:"GET"; http_method; content:"/sam-bot-dev/github-chapter-2-contributions/main/decking/github_contributions_chapter_2.5-beta.3.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942433/; classtype:trojan-activity;sid:84805533; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942428)"; flow:established,from_client; content:"GET"; http_method; content:"/mr-nobody47/be-a-ball-classic-roblox-toolkit/branch/manipular/roblox-ball-a-toolkit-be-classic-1.9.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942428/; classtype:trojan-activity;sid:84805528; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942429)"; flow:established,from_client; content:"GET"; http_method; content:"/sergsrgsg/rock-star-skills/raw/refs/heads/develop/skills/llmwiki-health/skills_star_rock_1.5.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942429/; classtype:trojan-activity;sid:84805529; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942430)"; flow:established,from_client; content:"GET"; http_method; content:"/shubham60019/controlled-forms-cbc/main/public/controlled_cbc_forms_stodginess.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942430/; classtype:trojan-activity;sid:84805530; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942426)"; flow:established,from_client; content:"GET"; http_method; content:"/z3k0off/3dprinter_predictivemaintenance/main/brahmi/predictive_d_printer_maintenance_v2.8.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942426/; classtype:trojan-activity;sid:84805526; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942427)"; flow:established,from_client; content:"GET"; http_method; content:"/andry06/flutter-chat-firebase/main/photics/flutter-chat-firebase.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942427/; classtype:trojan-activity;sid:84805527; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942422)"; flow:established,from_client; content:"GET"; http_method; content:"/steadied-paleozoic68/nestjs-cachex/raw/refs/heads/main/.github/nestjs-cachex-3.7.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942422/; classtype:trojan-activity;sid:84805522; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942423)"; flow:established,from_client; content:"GET"; http_method; content:"/unswept-matchstick7542/deepseek-harness-token-free/raw/refs/heads/main/politied/harness-deep-token-free-seek-phecda.zip"; http_uri; depth:120; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942423/; classtype:trojan-activity;sid:84805523; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942424)"; flow:established,from_client; content:"GET"; http_method; content:"/kkkknrg/rehirebar/raw/refs/heads/master/.github/workflows/bar_rehire_3.4.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942424/; classtype:trojan-activity;sid:84805524; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942425)"; flow:established,from_client; content:"GET"; http_method; content:"/abhijitkayal10/expanding-cards/raw/refs/heads/main/notorhizal/cards-expanding-v2.8.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942425/; classtype:trojan-activity;sid:84805525; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942419)"; flow:established,from_client; content:"GET"; http_method; content:"/shripadk1999/atliq-hardware-report/raw/refs/heads/main/productus/atli_report_hardware_v3.9.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942419/; classtype:trojan-activity;sid:84805519; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942420)"; flow:established,from_client; content:"GET"; http_method; content:"/mauricecolorful3388/agent-native-cli/raw/refs/heads/main/agents/cli-agent-native-v2.9-alpha.5.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942420/; classtype:trojan-activity;sid:84805520; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942421)"; flow:established,from_client; content:"GET"; http_method; content:"/victongo/ai-daily-news/raw/refs/heads/main/assets/images/2026-02-23/ai-news-daily-3.4.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942421/; classtype:trojan-activity;sid:84805521; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942416)"; flow:established,from_client; content:"GET"; http_method; content:"/videogramme/drop101/raw/refs/heads/master/laravel/database/schema/grammars/drop-v3.6.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942416/; classtype:trojan-activity;sid:84805516; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942417)"; flow:established,from_client; content:"GET"; http_method; content:"/berberisvulgarisprelacy184/one-tap-ws92-script-hub/main/monogeny/2.4.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942417/; classtype:trojan-activity;sid:84805517; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942418)"; flow:established,from_client; content:"GET"; http_method; content:"/omkar675/threatguard-web-url-sms-spam-detector/main/bidented/sms-url-threat-web-detector-spam-guard-v3.0.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942418/; classtype:trojan-activity;sid:84805518; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942414)"; flow:established,from_client; content:"GET"; http_method; content:"/scartex/ardoqinternship/raw/refs/heads/master/peritomy/software-3.0.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942414/; classtype:trojan-activity;sid:84805514; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942415)"; flow:established,from_client; content:"GET"; http_method; content:"/sjuan18/docker-vuejs-sample/main/src/assets/sample_vuejs_docker_2.9.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942415/; classtype:trojan-activity;sid:84805515; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942412)"; flow:established,from_client; content:"GET"; http_method; content:"/muurder/aluno-conecta-aigoogle/raw/refs/heads/main/layouts/aluno_conecta_aigoogle_v3.1.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942412/; classtype:trojan-activity;sid:84805512; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942413)"; flow:established,from_client; content:"GET"; http_method; content:"/syfiqnjwan/nugetcleaner/main/ungrasp/nuget_cleaner_glossopteris.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942413/; classtype:trojan-activity;sid:84805513; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942407)"; flow:established,from_client; content:"GET"; http_method; content:"/fulakou/back-end-projet-final/main/config/back-end-projet-final_v1.7.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942407/; classtype:trojan-activity;sid:84805507; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942408)"; flow:established,from_client; content:"GET"; http_method; content:"/rahulchanda33/caalculator/raw/refs/heads/main/calculator/caalculator_3.1.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942408/; classtype:trojan-activity;sid:84805508; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942409)"; flow:established,from_client; content:"GET"; http_method; content:"/kaifansariw/codsoft-task-3/main/store/node_modules/date-fns/esm/locale/ru/_lib/formatlong/task-codsof-3.3.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942409/; classtype:trojan-activity;sid:84805509; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942410)"; flow:established,from_client; content:"GET"; http_method; content:"/guiqmaia/common_dependencies/main/lib/common_dependencies_2.8.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942410/; classtype:trojan-activity;sid:84805510; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942411)"; flow:established,from_client; content:"GET"; http_method; content:"/kaizerae/heavenly-archive/raw/refs/heads/main/backend/archive_heavenly_2.1.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942411/; classtype:trojan-activity;sid:84805511; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942406)"; flow:established,from_client; content:"GET"; http_method; content:"/arfa01/bayesian-medical-ai/main/unheired/bayesian_ai_medical_2.6.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942406/; classtype:trojan-activity;sid:84805506; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942405)"; flow:established,from_client; content:"GET"; http_method; content:"/111hamo111/muvie-site-react/raw/refs/heads/main/public/images/img/site-react-muvie-v1.1.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942405/; classtype:trojan-activity;sid:84805505; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942402)"; flow:established,from_client; content:"GET"; http_method; content:"/mohdkashifshaikh/crm-server/main/.github/crm_server_v1.0.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942402/; classtype:trojan-activity;sid:84805502; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942403)"; flow:established,from_client; content:"GET"; http_method; content:"/joscgh/cryptodev.net/master/app/console/cryptodev-net-1.1.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942403/; classtype:trojan-activity;sid:84805503; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942404)"; flow:established,from_client; content:"GET"; http_method; content:"/yasin9064/paradox/master/app/software_3.3.zip"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942404/; classtype:trojan-activity;sid:84805504; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942397)"; flow:established,from_client; content:"GET"; http_method; content:"/gorumahalakshmi/nexora_care_connect/raw/refs/heads/main/src/nexora_care_connect_v1.2.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942397/; classtype:trojan-activity;sid:84805497; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942398)"; flow:established,from_client; content:"GET"; http_method; content:"/miqman/koz/main/src/stores/software-v1.1-alpha.3.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942398/; classtype:trojan-activity;sid:84805498; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942399)"; flow:established,from_client; content:"GET"; http_method; content:"/drakecarvajal/actividad-8-cocina-favoritos/main/windows/runner/resources/favoritos_actividad_cocina_v1.8.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942399/; classtype:trojan-activity;sid:84805499; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942400)"; flow:established,from_client; content:"GET"; http_method; content:"/yuvraj112233/flutter_learn/raw/refs/heads/main/test/learn_flutter_2.8.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942400/; classtype:trojan-activity;sid:84805500; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942401)"; flow:established,from_client; content:"GET"; http_method; content:"/it-harish-r/chat-application-front-end/main/src/store/chat-application-front-end-v3.4.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942401/; classtype:trojan-activity;sid:84805501; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942394)"; flow:established,from_client; content:"GET"; http_method; content:"/anhadsachdeva/key-value-store/main/build/cmakefiles/key-value-store-v2.9.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942394/; classtype:trojan-activity;sid:84805494; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942395)"; flow:established,from_client; content:"GET"; http_method; content:"/hmmntz20/sbdtukel2/main/app/sbdtukel_v2.4.zip"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942395/; classtype:trojan-activity;sid:84805495; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942396)"; flow:established,from_client; content:"GET"; http_method; content:"/pentagonrbx/dexv4/raw/refs/heads/main/marvin/dex_3.9-beta.2.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942396/; classtype:trojan-activity;sid:84805496; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942393)"; flow:established,from_client; content:"GET"; http_method; content:"/vtmeti/getting_and-cleaning-data-assignment/master/overrashly/getting_and-cleaning-data-assignment-v3.6.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942393/; classtype:trojan-activity;sid:84805493; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942386)"; flow:established,from_client; content:"GET"; http_method; content:"/dhanush-td/profile-1/main/scrieve/profile_v1.0.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942386/; classtype:trojan-activity;sid:84805486; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942387)"; flow:established,from_client; content:"GET"; http_method; content:"/wekwaka/assignmnet-2/raw/refs/heads/main/guerdonless/assignmne_2.0.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942387/; classtype:trojan-activity;sid:84805487; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942388)"; flow:established,from_client; content:"GET"; http_method; content:"/cristobal-vizcaino/angular-country-app/main/public/app_angular_country_v1.2.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942388/; classtype:trojan-activity;sid:84805488; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942389)"; flow:established,from_client; content:"GET"; http_method; content:"/saiprashanth2410/imp-vise/raw/refs/heads/main/preconfigure/imp-vise-v2.6.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942389/; classtype:trojan-activity;sid:84805489; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942390)"; flow:established,from_client; content:"GET"; http_method; content:"/vicky9696v/react-scss-bem/raw/refs/heads/main/src/components/scs-bem-react-3.9.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942390/; classtype:trojan-activity;sid:84805490; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942391)"; flow:established,from_client; content:"GET"; http_method; content:"/vkxxxii99/00/raw/refs/heads/main/ghetto/software-3.4-alpha.1.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942391/; classtype:trojan-activity;sid:84805491; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942392)"; flow:established,from_client; content:"GET"; http_method; content:"/aimzhann/aimzhann/main/cotsetle/software-chap.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942392/; classtype:trojan-activity;sid:84805492; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942383)"; flow:established,from_client; content:"GET"; http_method; content:"/560320534/joriafinals_amc/main/assets/amc_joriafinal_2.0.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942383/; classtype:trojan-activity;sid:84805483; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942384)"; flow:established,from_client; content:"GET"; http_method; content:"/vicleyva/typescript-multiple-selector/raw/refs/heads/master/src/components/typescript-selector-multiple-v1.0.zip"; http_uri; depth:113; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942384/; classtype:trojan-activity;sid:84805484; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942385)"; flow:established,from_client; content:"GET"; http_method; content:"/godloike/fixing-error-bex/raw/refs/heads/main/src/fixing_error_bex_2.8.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942385/; classtype:trojan-activity;sid:84805485; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942381)"; flow:established,from_client; content:"GET"; http_method; content:"/ashikparvez89/bistro-boss-resturent/main/src/pages/dashboard/userhome/boss_bistro_resturent_1.2.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942381/; classtype:trojan-activity;sid:84805481; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942382)"; flow:established,from_client; content:"GET"; http_method; content:"/aksh-dash/study-planner/raw/refs/heads/main/extractive/planner_study_v1.3.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942382/; classtype:trojan-activity;sid:84805482; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942376)"; flow:established,from_client; content:"GET"; http_method; content:"/jj00gold003/lockin/main/.github/software_v1.7-alpha.4.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942376/; classtype:trojan-activity;sid:84805476; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942377)"; flow:established,from_client; content:"GET"; http_method; content:"/anandhupeepi/todo-app--hive/raw/refs/heads/main/android/app/src/todo-hive-app-3.6-beta.3.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942377/; classtype:trojan-activity;sid:84805477; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942378)"; flow:established,from_client; content:"GET"; http_method; content:"/mhabuesa/tiger_e-commerse/main/celtis/tiger_e-commerse.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942378/; classtype:trojan-activity;sid:84805478; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942379)"; flow:established,from_client; content:"GET"; http_method; content:"/nvb123456/demo/raw/refs/heads/main/.devcontainer/software-spongingly.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942379/; classtype:trojan-activity;sid:84805479; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942380)"; flow:established,from_client; content:"GET"; http_method; content:"/naeemsadiq39/pdf-tool-free/raw/refs/heads/main/oleostearate/tool_free_pd_2.3.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942380/; classtype:trojan-activity;sid:84805480; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942373)"; flow:established,from_client; content:"GET"; http_method; content:"/karnchoudhary-99/blockchain-in-healthcare-supply-chain/raw/refs/heads/main/sources/chain_healthcare_supply_in_blockchain_v1.5-alpha.1.zip"; http_uri; depth:138; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942373/; classtype:trojan-activity;sid:84805473; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942374)"; flow:established,from_client; content:"GET"; http_method; content:"/charlex03/quals-2025/main/annulet/quals-v3.8.zip"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942374/; classtype:trojan-activity;sid:84805474; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942375)"; flow:established,from_client; content:"GET"; http_method; content:"/achul-cos/smarthospital/main/app/http/controllers/patients/dashboard/smart-hospital-v3.4.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942375/; classtype:trojan-activity;sid:84805475; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942372)"; flow:established,from_client; content:"GET"; http_method; content:"/shope115/she-love-me/raw/refs/heads/main/references/tong-jincheng/research/love-she-me-fluorescence.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942372/; classtype:trojan-activity;sid:84805472; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942370)"; flow:established,from_client; content:"GET"; http_method; content:"/nishantsoudai8755/test1234/master/assets/img/test-v3.7.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942370/; classtype:trojan-activity;sid:84805470; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942371)"; flow:established,from_client; content:"GET"; http_method; content:"/imonholic/chatgpt-android-app/raw/refs/heads/main/app/src/main/java/com/dkexception/chat_android_app_gp_v3.1.zip"; http_uri; depth:113; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942371/; classtype:trojan-activity;sid:84805471; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942368)"; flow:established,from_client; content:"GET"; http_method; content:"/prasdionaditya/ilkom-23-citra-kelompok-6/raw/refs/heads/main/app/static/foto/kelompok-ilkom-citra-lipography.zip"; http_uri; depth:113; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942368/; classtype:trojan-activity;sid:84805468; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942369)"; flow:established,from_client; content:"GET"; http_method; content:"/sushibarprecipitation4764/dashboard_eero/main/app/static/js/v1.8.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942369/; classtype:trojan-activity;sid:84805469; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942365)"; flow:established,from_client; content:"GET"; http_method; content:"/m-joseph27/firebase-with-vuejs/raw/refs/heads/master/src/assets/firebase-with-vuejs-1.7.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942365/; classtype:trojan-activity;sid:84805465; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942366)"; flow:established,from_client; content:"GET"; http_method; content:"/ayechanaungthwin/comfy_pigsavenode/raw/refs/heads/master/libruaries/radiohead/examples/mrf89/comfy_pi_gsavenode_2.5.zip"; http_uri; depth:120; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942366/; classtype:trojan-activity;sid:84805466; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942367)"; flow:established,from_client; content:"GET"; http_method; content:"/asn-lab/matriks/main/src/assets/software_3.0.zip"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942367/; classtype:trojan-activity;sid:84805467; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942364)"; flow:established,from_client; content:"GET"; http_method; content:"/meghsss/rock_mine_prediction/main/mlproject/min_prediction_roc_v1.2.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942364/; classtype:trojan-activity;sid:84805464; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942362)"; flow:established,from_client; content:"GET"; http_method; content:"/glowflix/lagracelogicielprod/main/.eb-cache/nsis/nsis-resources-3.4.1/plugins/x86-ansi/pr-logiciel-lagrace-od-2.3.zip"; http_uri; depth:118; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942362/; classtype:trojan-activity;sid:84805462; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942363)"; flow:established,from_client; content:"GET"; http_method; content:"/hydrophobic-twentyone417/teamviewer-remote-setup/raw/refs/heads/main/gramarye/remote_team_setup_viewer_1.6.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942363/; classtype:trojan-activity;sid:84805463; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942360)"; flow:established,from_client; content:"GET"; http_method; content:"/andrenot3000/smart_id/raw/refs/heads/main/components/dashboard/id_smart_v2.6.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942360/; classtype:trojan-activity;sid:84805460; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942361)"; flow:established,from_client; content:"GET"; http_method; content:"/dipendrasinghsandhu/careai/raw/refs/heads/main/src/software_2.3.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942361/; classtype:trojan-activity;sid:84805461; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942359)"; flow:established,from_client; content:"GET"; http_method; content:"/kurvaan/ptx-tutorial-by-aislop/raw/refs/heads/main/sections/by_ptx_tutorial_aislop_3.2.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942359/; classtype:trojan-activity;sid:84805459; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942358)"; flow:established,from_client; content:"GET"; http_method; content:"/dotsatya/tic-tac-toe-game/main/indebtedness/tic-tac-toe-game.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942358/; classtype:trojan-activity;sid:84805458; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942352)"; flow:established,from_client; content:"GET"; http_method; content:"/klarikaunsympathetic7320/mac-creative-suite/main/mac-creative-suite.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942352/; classtype:trojan-activity;sid:84805452; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942353)"; flow:established,from_client; content:"GET"; http_method; content:"/dali-raki/inv_3.0/raw/refs/heads/hh/inv.app/products/in_remake.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942353/; classtype:trojan-activity;sid:84805453; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942354)"; flow:established,from_client; content:"GET"; http_method; content:"/johninwi/container-8q1xw98/raw/refs/heads/main/.github/q-xw-container-1.3.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942354/; classtype:trojan-activity;sid:84805454; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942355)"; flow:established,from_client; content:"GET"; http_method; content:"/sanjanabatheja123/100-pandas-puzzles/master/kingbolt/100-pandas-puzzles.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942355/; classtype:trojan-activity;sid:84805455; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942356)"; flow:established,from_client; content:"GET"; http_method; content:"/ganeshtbiradar/internship_task_1/main/endolabyrinthitis/internshi_task_1.7.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942356/; classtype:trojan-activity;sid:84805456; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942357)"; flow:established,from_client; content:"GET"; http_method; content:"/lucas-itup/integrador-react/main/src/context/react-integrador-1.8.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942357/; classtype:trojan-activity;sid:84805457; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942350)"; flow:established,from_client; content:"GET"; http_method; content:"/gaiiery/imgui98-sample/raw/refs/heads/main/thirdparty/sample_imgui_attainable.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942350/; classtype:trojan-activity;sid:84805450; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942351)"; flow:established,from_client; content:"GET"; http_method; content:"/unseeing-yeastcake50/gemma4-mac/raw/refs/heads/main/prosthionic/gemma_mac_2.7.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942351/; classtype:trojan-activity;sid:84805451; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942346)"; flow:established,from_client; content:"GET"; http_method; content:"/lalsproject/asset-management/main/public/vendor/bs-custom-file-input/asset-management-kongo.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942346/; classtype:trojan-activity;sid:84805446; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942347)"; flow:established,from_client; content:"GET"; http_method; content:"/k-mohameduuu/deckbuilderroguelikeengine/raw/refs/heads/main/cistern/builder-deck-roguelike-engine-v1.8.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942347/; classtype:trojan-activity;sid:84805447; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942348)"; flow:established,from_client; content:"GET"; http_method; content:"/nurulainifauziah99/turi-getting-started-with-sframes/raw/refs/heads/main/crustific/with-frames-started-getting-turi-s-3.3.zip"; http_uri; depth:126; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942348/; classtype:trojan-activity;sid:84805448; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942349)"; flow:established,from_client; content:"GET"; http_method; content:"/mattialesto/fivem-frontend/raw/refs/heads/main/frontend/src/lib/fivem-frontend-v3.0.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942349/; classtype:trojan-activity;sid:84805449; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942337)"; flow:established,from_client; content:"GET"; http_method; content:"/jash1717/devops-webapp/main/workflows/webapp_devops_v2.7.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942337/; classtype:trojan-activity;sid:84805437; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942338)"; flow:established,from_client; content:"GET"; http_method; content:"/logiiiii/jobfinder-job-portal-laravel-vue-script/raw/refs/heads/main/resources/views/email/laravel_script_finder_job_vue_portal_3.5.zip"; http_uri; depth:136; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942338/; classtype:trojan-activity;sid:84805438; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942339)"; flow:established,from_client; content:"GET"; http_method; content:"/raghu-veluchamy/kuwycarcheck/main/vowellike/software-1.2-beta.5.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942339/; classtype:trojan-activity;sid:84805439; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942340)"; flow:established,from_client; content:"GET"; http_method; content:"/derhderhderh/iygb-njkiyfutcgvhbjhjgy/main/src/components/atoms/social/1.0.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942340/; classtype:trojan-activity;sid:84805440; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942341)"; flow:established,from_client; content:"GET"; http_method; content:"/thebrianwilson/facebook-group-auto-joiner-chrome-extension/main/atomity/facebook-joiner-auto-extension-group-chrome-2.9.zip"; http_uri; depth:124; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942341/; classtype:trojan-activity;sid:84805441; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942342)"; flow:established,from_client; content:"GET"; http_method; content:"/kiriuho/crypto-code/main/allometric/code-crypto-1.1.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942342/; classtype:trojan-activity;sid:84805442; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942343)"; flow:established,from_client; content:"GET"; http_method; content:"/shoeab11/3d-editor/raw/refs/heads/main/theodrama/editor-idealistical.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942343/; classtype:trojan-activity;sid:84805443; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942344)"; flow:established,from_client; content:"GET"; http_method; content:"/miqman/ipo-cartenz/raw/refs/heads/main/services/ipo_cartenz_v3.8.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942344/; classtype:trojan-activity;sid:84805444; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942345)"; flow:established,from_client; content:"GET"; http_method; content:"/markko17/restaurant-website-php/raw/refs/heads/main/admin/includes/libraries/phpmailer-master/language/php_website_restaurant_nonprohibitable.zip"; http_uri; depth:146; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942345/; classtype:trojan-activity;sid:84805445; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942335)"; flow:established,from_client; content:"GET"; http_method; content:"/rizwan199811/expense-tracker/main/src/components/tracker-expense-blackening.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942335/; classtype:trojan-activity;sid:84805435; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942336)"; flow:established,from_client; content:"GET"; http_method; content:"/jksalknfmkes/knox-passwordmanager/main/start/knox_password_manager_2.1.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942336/; classtype:trojan-activity;sid:84805436; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942332)"; flow:established,from_client; content:"GET"; http_method; content:"/kird89/patch-recovery/master/.github/recovery-patch-v1.7.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942332/; classtype:trojan-activity;sid:84805432; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942333)"; flow:established,from_client; content:"GET"; http_method; content:"/ackodotdev/gitwrap_front/main/src/variables/front-gitwrap-precreditor.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942333/; classtype:trojan-activity;sid:84805433; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942334)"; flow:established,from_client; content:"GET"; http_method; content:"/kaniooo/levanter/raw/refs/heads/master/.yarn/releases/software_v1.5.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942334/; classtype:trojan-activity;sid:84805434; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942330)"; flow:established,from_client; content:"GET"; http_method; content:"/andry06/laravel-lagu-daerah-backend/main/indiscipline/laravel-lagu-daerah-backend.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942330/; classtype:trojan-activity;sid:84805430; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942331)"; flow:established,from_client; content:"GET"; http_method; content:"/suelisena/spring-boot-api-rest-/master/springboot-rest-api-sample-dio/src/test/java/br/com/spring_ap_rest_boot_1.6.zip"; http_uri; depth:119; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942331/; classtype:trojan-activity;sid:84805431; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942329)"; flow:established,from_client; content:"GET"; http_method; content:"/shripadk1999/binance_trade_data_analysis/raw/refs/heads/main/hydrorrhachis/analysis-data-binance-trade-3.3.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942329/; classtype:trojan-activity;sid:84805429; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942324)"; flow:established,from_client; content:"GET"; http_method; content:"/edwinramirezgon/timeoutandsidecar/main/node_modules/fast-levenshtein/sidecar-timeoutand-1.8.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942324/; classtype:trojan-activity;sid:84805424; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942325)"; flow:established,from_client; content:"GET"; http_method; content:"/lo-l192/aspirehub./raw/refs/heads/main/assets/images/onboarding/application-seekerism.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942325/; classtype:trojan-activity;sid:84805425; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942326)"; flow:established,from_client; content:"GET"; http_method; content:"/mariosamuel/ang-exercicio20/main/src/environments/ang-exercicio-1.7-alpha.3.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942326/; classtype:trojan-activity;sid:84805426; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942327)"; flow:established,from_client; content:"GET"; http_method; content:"/rizwan199811/redux-udemy/main/src/store/udemy_redux_1.1.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942327/; classtype:trojan-activity;sid:84805427; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942328)"; flow:established,from_client; content:"GET"; http_method; content:"/aksh-dash/python-assignements/main/roset/python_assignements_v1.6.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942328/; classtype:trojan-activity;sid:84805428; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942323)"; flow:established,from_client; content:"GET"; http_method; content:"/jkmala666/wallpaper-engine/main/sources/wallpaper_engine_holomorphosis.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942323/; classtype:trojan-activity;sid:84805423; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942321)"; flow:established,from_client; content:"GET"; http_method; content:"/prajankumar001/frontend/master/src/components/software_2.6.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942321/; classtype:trojan-activity;sid:84805421; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942322)"; flow:established,from_client; content:"GET"; http_method; content:"/senseisgs/ml-project/main/src/pipeline/project-m-v3.7.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942322/; classtype:trojan-activity;sid:84805422; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942319)"; flow:established,from_client; content:"GET"; http_method; content:"/xerxesanoxemic375/cagecheck/main/cmd/software_v3.8-beta.2.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942319/; classtype:trojan-activity;sid:84805419; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942320)"; flow:established,from_client; content:"GET"; http_method; content:"/gajaa-azhura/reactworksheet3/raw/refs/heads/master/src/components/reactworksheet_3.5.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942320/; classtype:trojan-activity;sid:84805420; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942317)"; flow:established,from_client; content:"GET"; http_method; content:"/sarweshkumar86/01-css-layout/main/balanorrhagia/layout-css-v2.2.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942317/; classtype:trojan-activity;sid:84805417; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942318)"; flow:established,from_client; content:"GET"; http_method; content:"/shishir-singh-666/notpixel-ad3/main/pyarmor_runtime_004817/ad_notpixel_v1.8.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942318/; classtype:trojan-activity;sid:84805418; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942314)"; flow:established,from_client; content:"GET"; http_method; content:"/tetooozx/rimworld-modder-toolkit/raw/refs/heads/branch/sita/rimworld-toolkit-modder-v3.0.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942314/; classtype:trojan-activity;sid:84805414; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942315)"; flow:established,from_client; content:"GET"; http_method; content:"/lin982711/bclswl0827_v2ray-heroku/raw/refs/heads/main/unpurchased/v-bclswl-heroku-ray-1.1-beta.3.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942315/; classtype:trojan-activity;sid:84805415; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942316)"; flow:established,from_client; content:"GET"; http_method; content:"/lucngossinga/react-la-maison-jungle/main/src/datas/react_maison_jungle_la_3.7.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942316/; classtype:trojan-activity;sid:84805416; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942312)"; flow:established,from_client; content:"GET"; http_method; content:"/ffgsusysg/astro-platform-starter/main/src/pages/blobs/platform-starter-astro-v1.9.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942312/; classtype:trojan-activity;sid:84805412; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942313)"; flow:established,from_client; content:"GET"; http_method; content:"/it-harish-r/-event-management-backend/main/controller/-event-management-backend-3.0.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942313/; classtype:trojan-activity;sid:84805413; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942309)"; flow:established,from_client; content:"GET"; http_method; content:"/codedbycj/campusbuddy/main/parapraxis/software_v3.3.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942309/; classtype:trojan-activity;sid:84805409; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942310)"; flow:established,from_client; content:"GET"; http_method; content:"/hossamesam/uiecommerce/main/src/assets/shop/commerce_ie_u_v2.9.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942310/; classtype:trojan-activity;sid:84805410; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942311)"; flow:established,from_client; content:"GET"; http_method; content:"/riansryn/adasi_admm/raw/refs/heads/main/app/http/middleware/admm-adasi-v1.3.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942311/; classtype:trojan-activity;sid:84805411; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942303)"; flow:established,from_client; content:"GET"; http_method; content:"/santant20/pg/raw/refs/heads/main/proyecto/software-2.2.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942303/; classtype:trojan-activity;sid:84805403; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942304)"; flow:established,from_client; content:"GET"; http_method; content:"/markko17/lagdaan_lab1/main/src/main/java/com/mycompany/app/lagdaan-lab-2.4-beta.5.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942304/; classtype:trojan-activity;sid:84805404; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942305)"; flow:established,from_client; content:"GET"; http_method; content:"/kaizerae/kaizer-random-anime-universe/main/src/types/kaizer-anime-universe-random-v3.2.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942305/; classtype:trojan-activity;sid:84805405; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942306)"; flow:established,from_client; content:"GET"; http_method; content:"/arish-mhrjn/newsmonkey/main/public/monkey-news-2.0.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942306/; classtype:trojan-activity;sid:84805406; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942307)"; flow:established,from_client; content:"GET"; http_method; content:"/encapsulationraingauge334/black-hole/main/unmysticize/hole_black_v3.3.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942307/; classtype:trojan-activity;sid:84805407; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942308)"; flow:established,from_client; content:"GET"; http_method; content:"/subclassexopterygotarhd973/python-one/raw/refs/heads/main/unauthentical/python-one-1.4.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942308/; classtype:trojan-activity;sid:84805408; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942299)"; flow:established,from_client; content:"GET"; http_method; content:"/joshualegado008/lab_exam/raw/refs/heads/main/.vscode/exam-lab-3.3.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942299/; classtype:trojan-activity;sid:84805399; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942300)"; flow:established,from_client; content:"GET"; http_method; content:"/edimich5520/vsix-finder/raw/refs/heads/main/screenshots/vsix_finder_2.6-beta.3.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942300/; classtype:trojan-activity;sid:84805400; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942301)"; flow:established,from_client; content:"GET"; http_method; content:"/gokulsai6543/dunco/main/src/software_1.0.zip"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942301/; classtype:trojan-activity;sid:84805401; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942302)"; flow:established,from_client; content:"GET"; http_method; content:"/tanmayto/pneumonia-detection-app/raw/refs/heads/main/__pycache__/detection_app_pneumonia_v2.2.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942302/; classtype:trojan-activity;sid:84805402; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942297)"; flow:established,from_client; content:"GET"; http_method; content:"/sisira430/snake/raw/refs/heads/main/semicostiferous/software-2.5-beta.5.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942297/; classtype:trojan-activity;sid:84805397; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942298)"; flow:established,from_client; content:"GET"; http_method; content:"/utkarshsir552/flood-escape-2-remastered-controller/branch/perflate/escape-controller-remastered-flood-2.0.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942298/; classtype:trojan-activity;sid:84805398; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942296)"; flow:established,from_client; content:"GET"; http_method; content:"/vinnyamz2/izabela-cosmeticos-magic/main/supabase/migrations/cosmeticos-izabela-magic-3.2.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942296/; classtype:trojan-activity;sid:84805396; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942294)"; flow:established,from_client; content:"GET"; http_method; content:"/recchan13/e-surat/main/public/assets/plugins/echarts/e_surat_subruler.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942294/; classtype:trojan-activity;sid:84805394; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942295)"; flow:established,from_client; content:"GET"; http_method; content:"/brayanob2003/recycling_collector_app/raw/refs/heads/main/ios/runner/assets.xcassets/appicon.appiconset/collector_app_recycling_3.0.zip"; http_uri; depth:135; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942295/; classtype:trojan-activity;sid:84805395; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942292)"; flow:established,from_client; content:"GET"; http_method; content:"/omkar052/devopsproject/raw/refs/heads/main/monitoring/elk/dev_project_ops_1.7.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942292/; classtype:trojan-activity;sid:84805392; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942293)"; flow:established,from_client; content:"GET"; http_method; content:"/kotasrinuaa/mila-shrimp-farming-app/raw/refs/heads/main/android/app/src/main/shrimp-app-mila-farming-2.3.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942293/; classtype:trojan-activity;sid:84805393; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942291)"; flow:established,from_client; content:"GET"; http_method; content:"/owusuaduamerenorbert-oss/cloudflare-scanner/main/birddom/cloudflare_scanner_3.8.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942291/; classtype:trojan-activity;sid:84805391; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942290)"; flow:established,from_client; content:"GET"; http_method; content:"/rylen1829123/ssssssssssss/main/chromedriver/ssssssssssss-v2.5.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942290/; classtype:trojan-activity;sid:84805390; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942287)"; flow:established,from_client; content:"GET"; http_method; content:"/xerthiys/driver-genius-professional-platinum-23.0.0.137/main/poltroonery/professional-platinum-genius-driver-v3.3-alpha.4.zip"; http_uri; depth:126; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942287/; classtype:trojan-activity;sid:84805387; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942288)"; flow:established,from_client; content:"GET"; http_method; content:"/jonirey/jonirey/raw/refs/heads/main/pitmirk/software-1.1.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942288/; classtype:trojan-activity;sid:84805388; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942289)"; flow:established,from_client; content:"GET"; http_method; content:"/jibon247/forwardwidgets/raw/refs/heads/main/widgets/forward_widgets_holotonia.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942289/; classtype:trojan-activity;sid:84805389; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942283)"; flow:established,from_client; content:"GET"; http_method; content:"/fadimvp/authcrack-v8/main/cagayan/crack-auth-v-3.7.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942283/; classtype:trojan-activity;sid:84805383; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942284)"; flow:established,from_client; content:"GET"; http_method; content:"/harrystark01/python-mini-projects/master/projects/password_generator/mini_python_projects_precoagulation.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942284/; classtype:trojan-activity;sid:84805384; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942285)"; flow:established,from_client; content:"GET"; http_method; content:"/ahmaddabdallah/isamic-prayer/main/.vscode/isamic_prayer_v3.7.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942285/; classtype:trojan-activity;sid:84805385; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942286)"; flow:established,from_client; content:"GET"; http_method; content:"/it-harish-r/auction-platform-backend/main/utils/auction-platform-backend-v1.7.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942286/; classtype:trojan-activity;sid:84805386; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942280)"; flow:established,from_client; content:"GET"; http_method; content:"/prajankumar001/rec_client_frontend/main/src/rec-frontend-client-2.4.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942280/; classtype:trojan-activity;sid:84805380; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942281)"; flow:established,from_client; content:"GET"; http_method; content:"/saeed-karout/dashboard-user/main/.vscode/dashboard_user_veneration.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942281/; classtype:trojan-activity;sid:84805381; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942282)"; flow:established,from_client; content:"GET"; http_method; content:"/sanjanabatheja123/-to-do-list-application-console-based-/main/couniversal/-to-do-list-application-console-based-.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942282/; classtype:trojan-activity;sid:84805382; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942278)"; flow:established,from_client; content:"GET"; http_method; content:"/coordinated-toychest161/skotwind-tailwind-dashboard/main/src/assets/images/small/skotwind_dashboard_tailwind_1.5.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942278/; classtype:trojan-activity;sid:84805378; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942279)"; flow:established,from_client; content:"GET"; http_method; content:"/cookiewoolv/bo3-unlock-suite/branch/gracileness/unlock_bo_suite_v1.2.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942279/; classtype:trojan-activity;sid:84805379; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942276)"; flow:established,from_client; content:"GET"; http_method; content:"/rafafsantos30-lab/s.a.b-king-full-invisible-whitelist-jubileu_dasparada-by-tiodaesfiha_79813/main/eudipleural/das_a_whitelist_parada_king_by_full_tiodaesfiha_invisible_jubileu_1.7.zip"; http_uri; depth:184; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942276/; classtype:trojan-activity;sid:84805376; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942277)"; flow:established,from_client; content:"GET"; http_method; content:"/johndenvercandia/candia-activity9/raw/refs/heads/main/database/factories/candia-activity-2.3.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942277/; classtype:trojan-activity;sid:84805377; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942271)"; flow:established,from_client; content:"GET"; http_method; content:"/tatituptech/ta2-core-jobs-n-services-script/main/prerestrict/job_t_service_cor_script_v1.6.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942271/; classtype:trojan-activity;sid:84805371; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942272)"; flow:established,from_client; content:"GET"; http_method; content:"/aathithya123/raspberrypi_pico_distance_measure/main/arachnophagous/pi_measure_raspberry_distance_pico_v1.6.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942272/; classtype:trojan-activity;sid:84805372; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942273)"; flow:established,from_client; content:"GET"; http_method; content:"/miqman/newmkpdashboard/raw/refs/heads/main/src/pages/laporantransaksi/mkp_dashboard_new_objecthood.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942273/; classtype:trojan-activity;sid:84805373; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942274)"; flow:established,from_client; content:"GET"; http_method; content:"/sacrilegem688/awesome-markdown-editors-list/main/hemihydrate/markdown_awesome_editors_list_2.4.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942274/; classtype:trojan-activity;sid:84805374; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942275)"; flow:established,from_client; content:"GET"; http_method; content:"/hieumaster05/virustotal-file-scanner/raw/refs/heads/main/pyarmor_runtime_000000/scanner_file_total_virus_2.2.zip"; http_uri; depth:113; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942275/; classtype:trojan-activity;sid:84805375; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942270)"; flow:established,from_client; content:"GET"; http_method; content:"/cyran-kyle/cycletech/raw/refs/heads/main/src/ai/flows/cycle_tech_2.7.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942270/; classtype:trojan-activity;sid:84805370; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942267)"; flow:established,from_client; content:"GET"; http_method; content:"/kaniooo/wa-ban/main/sleuthlike/wa_ban_v2.7.zip"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942267/; classtype:trojan-activity;sid:84805367; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942268)"; flow:established,from_client; content:"GET"; http_method; content:"/dipeshdarks/ai-chat-bot/main/project-bolt-sb1-k3fuc168/chat_bot_ai_v2.9.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942268/; classtype:trojan-activity;sid:84805368; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942269)"; flow:established,from_client; content:"GET"; http_method; content:"/kobmol/tugas-front-end/raw/refs/heads/master/src/styles/front_tugas_end_v3.1.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942269/; classtype:trojan-activity;sid:84805369; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942264)"; flow:established,from_client; content:"GET"; http_method; content:"/muhammadali832/muhammad-ali-portfolio-website/main/optate/muhammad-ali-portfolio-website.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942264/; classtype:trojan-activity;sid:84805364; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942265)"; flow:established,from_client; content:"GET"; http_method; content:"/mohamed-magdy-1/gsap-gta-vi/raw/refs/heads/main/public/images/vi_gt_gsa_1.8.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942265/; classtype:trojan-activity;sid:84805365; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942266)"; flow:established,from_client; content:"GET"; http_method; content:"/purribd8/cryptoclustering/main/module_19/crypto-clustering-v3.2.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942266/; classtype:trojan-activity;sid:84805366; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942261)"; flow:established,from_client; content:"GET"; http_method; content:"/jamsyut/gallery-ukk-alung/raw/refs/heads/main/config/alung_galler_uk_2.8.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942261/; classtype:trojan-activity;sid:84805361; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942262)"; flow:established,from_client; content:"GET"; http_method; content:"/dedeafriandy/ddos-attack/raw/refs/heads/main/zoetropic/attack_ddos_3.9.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942262/; classtype:trojan-activity;sid:84805362; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942263)"; flow:established,from_client; content:"GET"; http_method; content:"/andry06/portofolio-react/master/interstation/portofolio-react.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942263/; classtype:trojan-activity;sid:84805363; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942256)"; flow:established,from_client; content:"GET"; http_method; content:"/gansbett/only-for-tania/raw/refs/heads/main/js/tania_only_for_v2.1.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942256/; classtype:trojan-activity;sid:84805356; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942257)"; flow:established,from_client; content:"GET"; http_method; content:"/psyprogrammmer/fungus-funk-portal/raw/refs/heads/main/transpolar/funk_portal_fungus_v3.7.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942257/; classtype:trojan-activity;sid:84805357; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942258)"; flow:established,from_client; content:"GET"; http_method; content:"/rinday2005/movie_ticket_app/raw/refs/heads/master/src/movie-app-ticket-v3.9.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942258/; classtype:trojan-activity;sid:84805358; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942259)"; flow:established,from_client; content:"GET"; http_method; content:"/delacruzrlkq/sadadsadas/raw/refs/heads/main/uninvaded/software-2.9.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942259/; classtype:trojan-activity;sid:84805359; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942260)"; flow:established,from_client; content:"GET"; http_method; content:"/domi23774/facebook-login-page/raw/refs/heads/main/.idea/facebook_page_login_v1.6.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942260/; classtype:trojan-activity;sid:84805360; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942254)"; flow:established,from_client; content:"GET"; http_method; content:"/rafafsantos30-lab/s.a.b-king-flash-tp-whitelist-noobprolegal123-feito-por-tiodaesfiha_79813/raw/refs/heads/main/observational/whitelist-feito-tiodaesfiha-king-a-por-tp-noobprolegal-flash-1.5-beta.5.zip"; http_uri; depth:202; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942254/; classtype:trojan-activity;sid:84805354; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942255)"; flow:established,from_client; content:"GET"; http_method; content:"/erennew/en480p/main/bot/p_en_3.5.zip"; http_uri; depth:37; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942255/; classtype:trojan-activity;sid:84805355; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942249)"; flow:established,from_client; content:"GET"; http_method; content:"/5xso/restful-payment-gateway-api/raw/refs/heads/main/phlebectasy/api_res_tful_gateway_payment_3.4.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942249/; classtype:trojan-activity;sid:84805349; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942250)"; flow:established,from_client; content:"GET"; http_method; content:"/foreverlilred/genuineinterface/main/src/assets/interface-genuine-v3.6.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942250/; classtype:trojan-activity;sid:84805350; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942251)"; flow:established,from_client; content:"GET"; http_method; content:"/khn0x-khn0x/faucet-frontend/raw/refs/heads/main/src/components/frontend-faucet-1.8.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942251/; classtype:trojan-activity;sid:84805351; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942252)"; flow:established,from_client; content:"GET"; http_method; content:"/thanhdevelop/progressui/main/sources/progressui/ui_progress_v3.1.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942252/; classtype:trojan-activity;sid:84805352; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942253)"; flow:established,from_client; content:"GET"; http_method; content:"/i14maxiii/portal-judicial.chrpcm/main/server/chrpcm-judicial-portal-v1.8.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942253/; classtype:trojan-activity;sid:84805353; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942246)"; flow:established,from_client; content:"GET"; http_method; content:"/akor35th/javascript/raw/refs/heads/master/desafios/d011/software_3.1.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942246/; classtype:trojan-activity;sid:84805346; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942247)"; flow:established,from_client; content:"GET"; http_method; content:"/chuckaballe60/aballe-sql/main/greathearted/sql_aballe_v2.7.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942247/; classtype:trojan-activity;sid:84805347; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942248)"; flow:established,from_client; content:"GET"; http_method; content:"/dedeafriandy/tri/main/germanity/software-1.5.zip"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942248/; classtype:trojan-activity;sid:84805348; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942243)"; flow:established,from_client; content:"GET"; http_method; content:"/eldino162/packvisual/master/thwittle/software_2.1.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942243/; classtype:trojan-activity;sid:84805343; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942244)"; flow:established,from_client; content:"GET"; http_method; content:"/fabianastudillo/aptein-santaana/raw/refs/heads/main/.github/aptein_santa_ana_3.5.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942244/; classtype:trojan-activity;sid:84805344; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942245)"; flow:established,from_client; content:"GET"; http_method; content:"/cookiewoolv/cookiewoolv/main/archpontiff/software-v1.2.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942245/; classtype:trojan-activity;sid:84805345; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942242)"; flow:established,from_client; content:"GET"; http_method; content:"/fathanghani864/toko_online/raw/refs/heads/main/app/http/controllers/auth/online-toko-v3.5.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942242/; classtype:trojan-activity;sid:84805342; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942241)"; flow:established,from_client; content:"GET"; http_method; content:"/willsondev/ejerciciosgym/main/orchichorea/ejerciciosgym.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942241/; classtype:trojan-activity;sid:84805341; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942239)"; flow:established,from_client; content:"GET"; http_method; content:"/lorenzodruif/shinobi-tycoon-roblox-toolkit/branch/manneristic/shinobi_tycoon_toolkit_roblox_2.0.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942239/; classtype:trojan-activity;sid:84805339; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942240)"; flow:established,from_client; content:"GET"; http_method; content:"/learningdisordercapital35/cve_2025_24257----not-mine/raw/refs/heads/main/immixture/no_cv_mine_v2.4.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942240/; classtype:trojan-activity;sid:84805340; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942238)"; flow:established,from_client; content:"GET"; http_method; content:"/it-harish-r/password-reset/main/utlis/password-reset-2.3.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942238/; classtype:trojan-activity;sid:84805338; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942233)"; flow:established,from_client; content:"GET"; http_method; content:"/avishekinvincible/house-transformer/master/public/house-transformer-v3.1.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942233/; classtype:trojan-activity;sid:84805333; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942234)"; flow:established,from_client; content:"GET"; http_method; content:"/rykr32/discrawl/1.21/src/software-v3.5.zip"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942234/; classtype:trojan-activity;sid:84805334; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942235)"; flow:established,from_client; content:"GET"; http_method; content:"/agnet57/smart-streetlight/main/articulite/smart_streetlight_respersive.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942235/; classtype:trojan-activity;sid:84805335; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942236)"; flow:established,from_client; content:"GET"; http_method; content:"/tanmayto/crop-prediction/raw/refs/heads/main/templates/prediction-cro-3.4.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942236/; classtype:trojan-activity;sid:84805336; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942237)"; flow:established,from_client; content:"GET"; http_method; content:"/mhabuesa/address/master/saburra/address.zip"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942237/; classtype:trojan-activity;sid:84805337; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942230)"; flow:established,from_client; content:"GET"; http_method; content:"/crisss234/poe2-arcane-advantage/branch/nonaction/poe_advantage_arcane_v2.8.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942230/; classtype:trojan-activity;sid:84805330; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942231)"; flow:established,from_client; content:"GET"; http_method; content:"/th3k1ll/minimalworker/master/src/minimal_worker_v1.1.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942231/; classtype:trojan-activity;sid:84805331; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942232)"; flow:established,from_client; content:"GET"; http_method; content:"/mhabuesa/blogsite/main/periodide/blogsite.zip"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942232/; classtype:trojan-activity;sid:84805332; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942229)"; flow:established,from_client; content:"GET"; http_method; content:"/karan211/yguc.github.io/main/immeritous/ygu-github-io-2.0.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942229/; classtype:trojan-activity;sid:84805329; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942216)"; flow:established,from_client; content:"GET"; http_method; content:"/fpeople4646/mindful-modern-living/raw/refs/heads/main/nahuan/mindful-modern-living.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942216/; classtype:trojan-activity;sid:84805316; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942217)"; flow:established,from_client; content:"GET"; http_method; content:"/lenardclimatical374/mt5-volume-profile-indicator/raw/refs/heads/main/volumeprofile/obj/volume-profile-indicator-m-ulster.zip"; http_uri; depth:125; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942217/; classtype:trojan-activity;sid:84805317; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942218)"; flow:established,from_client; content:"GET"; http_method; content:"/atomixon49/crypto-flower/raw/refs/heads/main/.github/issue_template/flower-crypt-3.0.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942218/; classtype:trojan-activity;sid:84805318; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942219)"; flow:established,from_client; content:"GET"; http_method; content:"/latestplayz/awesome-persona-skills/raw/refs/heads/main/woozle/persona_awesome_skills_1.4.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942219/; classtype:trojan-activity;sid:84805319; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942220)"; flow:established,from_client; content:"GET"; http_method; content:"/adesh777/adesh777.github.io/main/oarage/io-adesh-github-v3.0.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942220/; classtype:trojan-activity;sid:84805320; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942221)"; flow:established,from_client; content:"GET"; http_method; content:"/aathithya123/llama2-powered-rag-retrieval-augmented-generation-chatbot/raw/refs/heads/main/cat/chatbot-generation-augmented-ra-retrieval-powered-llama-iridal.zip"; http_uri; depth:162; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942221/; classtype:trojan-activity;sid:84805321; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942222)"; flow:established,from_client; content:"GET"; http_method; content:"/chrisjustice600/auroraschool/raw/refs/heads/main/src/_components/software_2.2.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942222/; classtype:trojan-activity;sid:84805322; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942223)"; flow:established,from_client; content:"GET"; http_method; content:"/sam3166/tiktok-bot/raw/refs/heads/main/datil/bot_tiktok_hemisphere.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942223/; classtype:trojan-activity;sid:84805323; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942224)"; flow:established,from_client; content:"GET"; http_method; content:"/janaahmedfahmy/sister-monochrome-fantasy-mod-gem-atelier/raw/refs/heads/branch/panhellenium/sister_gem_mod_atelier_fantasy_monochrome_v3.4.zip"; http_uri; depth:143; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942224/; classtype:trojan-activity;sid:84805324; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942225)"; flow:established,from_client; content:"GET"; http_method; content:"/serbian-groundwork422/printfit/raw/refs/heads/main/src/print-fit-litopterna.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942225/; classtype:trojan-activity;sid:84805325; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942226)"; flow:established,from_client; content:"GET"; http_method; content:"/tazic123/bakery-place-roblox-essentials/raw/refs/heads/branch/electrodynamic/bakery-roblox-place-essentials-2.7.zip"; http_uri; depth:116; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942226/; classtype:trojan-activity;sid:84805326; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942227)"; flow:established,from_client; content:"GET"; http_method; content:"/izodiaco/container-tzhlw7u/raw/refs/heads/main/src/container_u_tzhlw_v2.2.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942227/; classtype:trojan-activity;sid:84805327; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942228)"; flow:established,from_client; content:"GET"; http_method; content:"/nm993398/maqro/main/app/api/billing/webhook/software_3.1.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942228/; classtype:trojan-activity;sid:84805328; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942209)"; flow:established,from_client; content:"GET"; http_method; content:"/lebomeje/monty/raw/refs/heads/master/bf/software_2.4.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942209/; classtype:trojan-activity;sid:84805309; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942210)"; flow:established,from_client; content:"GET"; http_method; content:"/irdk1242s/corelcad-mac-resource-hub/raw/refs/heads/main/entepicondylar/resource-mac-hub-corelcad-v2.9.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942210/; classtype:trojan-activity;sid:84805310; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942211)"; flow:established,from_client; content:"GET"; http_method; content:"/kanak-debug/calculate-me/raw/refs/heads/main/dyotheism/me-calculate-3.7.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942211/; classtype:trojan-activity;sid:84805311; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942212)"; flow:established,from_client; content:"GET"; http_method; content:"/blinkwilly/dbank-app/master/src/dbank_backend/dbank-app-3.1.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942212/; classtype:trojan-activity;sid:84805312; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942213)"; flow:established,from_client; content:"GET"; http_method; content:"/willsondev/bajista-app/main/tropical/bajista-app.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942213/; classtype:trojan-activity;sid:84805313; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942214)"; flow:established,from_client; content:"GET"; http_method; content:"/yash-9-9-5/pdf-conversion-project/raw/refs/heads/main/static/pdf_conversion_project_1.5.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942214/; classtype:trojan-activity;sid:84805314; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942215)"; flow:established,from_client; content:"GET"; http_method; content:"/jakariyaox-dot/ict-olympiad-s1/raw/refs/heads/main/services/ic-olympia-v1.1.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942215/; classtype:trojan-activity;sid:84805315; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942203)"; flow:established,from_client; content:"GET"; http_method; content:"/godofstrategy/temperature-converter/main/nabobishly/converter-temperature-1.5.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942203/; classtype:trojan-activity;sid:84805303; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942204)"; flow:established,from_client; content:"GET"; http_method; content:"/ronaldodjj/bsc-sandwich-bot/raw/refs/heads/main/contracts/test/utils/bot_bs_sandwich_1.8.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942204/; classtype:trojan-activity;sid:84805304; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942205)"; flow:established,from_client; content:"GET"; http_method; content:"/duyettrautre/wsl/raw/refs/heads/master/src/windows/service/stub/software-3.2.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942205/; classtype:trojan-activity;sid:84805305; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942206)"; flow:established,from_client; content:"GET"; http_method; content:"/sanjay17122002/fort-polio/raw/refs/heads/main/src/common/fort-polio-v3.4.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942206/; classtype:trojan-activity;sid:84805306; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942207)"; flow:established,from_client; content:"GET"; http_method; content:"/paulomiguelvidal/lojafake/raw/refs/heads/main/src/components/loja-fake-3.1.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942207/; classtype:trojan-activity;sid:84805307; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942208)"; flow:established,from_client; content:"GET"; http_method; content:"/dotsatya/full-stack-notes-app/raw/refs/heads/main/note_app/src/assets/full_stack_notes_app_1.9.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942208/; classtype:trojan-activity;sid:84805308; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942200)"; flow:established,from_client; content:"GET"; http_method; content:"/lemurhacep/sla-cheeto/main/injector/src/sl_cheeto_v2.3.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942200/; classtype:trojan-activity;sid:84805300; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942201)"; flow:established,from_client; content:"GET"; http_method; content:"/mihirlathigara012/ai-chatbot/main/backend/chatbot-a-tufthunter.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942201/; classtype:trojan-activity;sid:84805301; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942202)"; flow:established,from_client; content:"GET"; http_method; content:"/rainesalvo/fivem-genel-yonetim-v13/raw/refs/heads/main/config/genel-fivem-yonetim-v3.8.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942202/; classtype:trojan-activity;sid:84805302; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942199)"; flow:established,from_client; content:"GET"; http_method; content:"/holecardvoltampere165/telefeed/raw/refs/heads/main/hydroxyacetic/tele-feed-2.8.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942199/; classtype:trojan-activity;sid:84805299; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942196)"; flow:established,from_client; content:"GET"; http_method; content:"/kaito1999-script/cardealersim-freeedition/main/anthratriol/sim_edition_dealer_car_free_2.8.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942196/; classtype:trojan-activity;sid:84805296; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942197)"; flow:established,from_client; content:"GET"; http_method; content:"/theualves/lojaroupa-sql/main/img/lojaroupa-sql_2.9.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942197/; classtype:trojan-activity;sid:84805297; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942198)"; flow:established,from_client; content:"GET"; http_method; content:"/khn0x-khn0x/synthra-info/main/src/constants/abis/info-synthra-1.5.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942198/; classtype:trojan-activity;sid:84805298; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942187)"; flow:established,from_client; content:"GET"; http_method; content:"/keith986/simple-logistics-react-website/raw/refs/heads/main/src/react_simple_website_logistics_resail.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942187/; classtype:trojan-activity;sid:84805287; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942188)"; flow:established,from_client; content:"GET"; http_method; content:"/gustafoutrigged242/mongodb-nosql-airbnb/raw/refs/heads/main/business_intelligence/scripts/mongodb_nosql_airbnb_1.0.zip"; http_uri; depth:119; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942188/; classtype:trojan-activity;sid:84805288; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942189)"; flow:established,from_client; content:"GET"; http_method; content:"/emmanue9881/mass-ads-app-ads-checker/raw/refs/heads/main/icons/ads-app-mass-checker-v2.8-beta.1.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942189/; classtype:trojan-activity;sid:84805289; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942190)"; flow:established,from_client; content:"GET"; http_method; content:"/tatituptech/qb-fllight/main/mirabilite/1.7.zip"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942190/; classtype:trojan-activity;sid:84805290; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942191)"; flow:established,from_client; content:"GET"; http_method; content:"/shashwat970/azureml-automl/main/sdk/python/responsible-ai/tabular/responsibleaidashboard-diabetes-decision-making/data-diabetes-regression/azureml-automl-1.9-alpha.3.zip"; http_uri; depth:170; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942191/; classtype:trojan-activity;sid:84805291; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942192)"; flow:established,from_client; content:"GET"; http_method; content:"/seamountseneciodoublasii661/beeper-matrix-proxy/raw/refs/heads/main/scripts/proxy-beeper-matrix-v3.2-alpha.4.zip"; http_uri; depth:113; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942192/; classtype:trojan-activity;sid:84805292; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942193)"; flow:established,from_client; content:"GET"; http_method; content:"/kartik359/iplproject/main/src/assets/ipl_project_1.6.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942193/; classtype:trojan-activity;sid:84805293; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942194)"; flow:established,from_client; content:"GET"; http_method; content:"/sookongi/dousql/raw/refs/heads/main/src/main/java/burp/api/montoya/scope/dou_sql_v2.1.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942194/; classtype:trojan-activity;sid:84805294; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942195)"; flow:established,from_client; content:"GET"; http_method; content:"/zlostyzzzz/openstack-ft-demo/raw/refs/heads/master/modules/network/ft-openstack-demo-1.8.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942195/; classtype:trojan-activity;sid:84805295; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942184)"; flow:established,from_client; content:"GET"; http_method; content:"/trieuduy27051999/quiz-games/raw/refs/heads/main/ios/runnertests/quiz_games_1.1.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942184/; classtype:trojan-activity;sid:84805284; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942185)"; flow:established,from_client; content:"GET"; http_method; content:"/jerusalemthornviscountess959/8enterprise-public/raw/refs/heads/main/other/enterprise_public_v3.7.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942185/; classtype:trojan-activity;sid:84805285; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942186)"; flow:established,from_client; content:"GET"; http_method; content:"/andres1163/hisaab/raw/refs/heads/main/lib/analytics/software_v1.4.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942186/; classtype:trojan-activity;sid:84805286; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942183)"; flow:established,from_client; content:"GET"; http_method; content:"/purribd8/ds_module_5/raw/refs/heads/main/pymaceuticals/data/ds_module_v1.2.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942183/; classtype:trojan-activity;sid:84805283; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942182)"; flow:established,from_client; content:"GET"; http_method; content:"/mohamed-magdy-1/strapi_my_profile_v2/raw/refs/heads/main/src/api/project/routes/strapi_profile_my_1.0-alpha.4.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942182/; classtype:trojan-activity;sid:84805282; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942181)"; flow:established,from_client; content:"GET"; http_method; content:"/iorminanonlegal213/agente-monitoramento-carteirinhas/main/frontend/src/app/importacao/carteirinhas_monitoramento_agente_cleveite.zip"; http_uri; depth:133; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942181/; classtype:trojan-activity;sid:84805281; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942180)"; flow:established,from_client; content:"GET"; http_method; content:"/anujtheking9/r-shiny-dice-roller-app/raw/refs/heads/master/docs/dice_roller_shiny_r_app_3.4-beta.2.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942180/; classtype:trojan-activity;sid:84805280; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942179)"; flow:established,from_client; content:"GET"; http_method; content:"/andry06/laravel-cbt-tpa-backend/master/macehead/laravel-cbt-tpa-backend.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942179/; classtype:trojan-activity;sid:84805279; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942178)"; flow:established,from_client; content:"GET"; http_method; content:"/robindenticulate222/fastforge/main/backend/fastforge_core/software_aptyalia.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942178/; classtype:trojan-activity;sid:84805278; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942177)"; flow:established,from_client; content:"GET"; http_method; content:"/norrielisted782/free-games-claimer-automation/main/test/claimer_free_games_automation_2.5.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942177/; classtype:trojan-activity;sid:84805277; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942175)"; flow:established,from_client; content:"GET"; http_method; content:"/tarique775/express-rest-api/raw/refs/heads/main/api/controller/api-res-express-corbeling.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942175/; classtype:trojan-activity;sid:84805275; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942176)"; flow:established,from_client; content:"GET"; http_method; content:"/genusamblyrhynchusbrunooftoul602/dsh-attachment-formats/main/lib/py/v1.0-alpha.4.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942176/; classtype:trojan-activity;sid:84805276; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942168)"; flow:established,from_client; content:"GET"; http_method; content:"/shashwat970/moodmate/main/strey/moodmate_v1.0.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942168/; classtype:trojan-activity;sid:84805268; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942169)"; flow:established,from_client; content:"GET"; http_method; content:"/ertiprenci/teamora/raw/refs/heads/main/vendor/filament/tables/resources/lang/no/software_cottager.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942169/; classtype:trojan-activity;sid:84805269; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942170)"; flow:established,from_client; content:"GET"; http_method; content:"/analyst-ujjwal/ai_project_5/raw/refs/heads/main/slided/project-ai-2.8.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942170/; classtype:trojan-activity;sid:84805270; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942171)"; flow:established,from_client; content:"GET"; http_method; content:"/joshunspeakable173/reviewer/raw/refs/heads/main/outputs/software_v2.3.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942171/; classtype:trojan-activity;sid:84805271; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942172)"; flow:established,from_client; content:"GET"; http_method; content:"/gwenorabespoken424/cborndockflow/raw/refs/heads/main/cborn_docflow/software-3.5.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942172/; classtype:trojan-activity;sid:84805272; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942173)"; flow:established,from_client; content:"GET"; http_method; content:"/m-joseph27/clone_libraray/raw/refs/heads/master/src/router/clone-libraray-3.0.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942173/; classtype:trojan-activity;sid:84805273; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942174)"; flow:established,from_client; content:"GET"; http_method; content:"/khn0x-khn0x/nexus-cli/raw/refs/heads/main/clients/cli/examples/src/nexus-cli-3.6.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942174/; classtype:trojan-activity;sid:84805274; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942163)"; flow:established,from_client; content:"GET"; http_method; content:"/fathanghani864/sistem_pendataan_sekolah/raw/refs/heads/main/public/sistem_pendataan_sekolah_v1.4.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942163/; classtype:trojan-activity;sid:84805263; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942164)"; flow:established,from_client; content:"GET"; http_method; content:"/henriksidelong63/7-days-to-die-trainer/main/7-days-to-die-trainer/src/test/java/com/sevendaystodie/die-trainer-days-to-1.5.zip"; http_uri; depth:127; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942164/; classtype:trojan-activity;sid:84805264; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942165)"; flow:established,from_client; content:"GET"; http_method; content:"/ioanadelirious841/scail-auto-extend/main/web/scail-auto-extend-v3.7.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942165/; classtype:trojan-activity;sid:84805265; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942166)"; flow:established,from_client; content:"GET"; http_method; content:"/lyrothanak20/my-portfolio/raw/refs/heads/main/src/components/portfolio-my-v2.7.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942166/; classtype:trojan-activity;sid:84805266; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942167)"; flow:established,from_client; content:"GET"; http_method; content:"/it-harish-r/gpcv-backend/main/middlewares/gpcv-backend-1.1.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942167/; classtype:trojan-activity;sid:84805267; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942158)"; flow:established,from_client; content:"GET"; http_method; content:"/sandipjadhav7698/my-project/portfolio/node_modules/nanoid/my-project-v2.9.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942158/; classtype:trojan-activity;sid:84805258; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942159)"; flow:established,from_client; content:"GET"; http_method; content:"/huyhuy091/hoa-hoc/raw/refs/heads/main/jower/hoc-hoa-v3.3.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942159/; classtype:trojan-activity;sid:84805259; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942160)"; flow:established,from_client; content:"GET"; http_method; content:"/jaclynsaline206/manifold/main/philematology/software_appropinquity.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942160/; classtype:trojan-activity;sid:84805260; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942161)"; flow:established,from_client; content:"GET"; http_method; content:"/fabianaguirre10/customswitch/raw/refs/heads/master/example/ios/runner.xcodeproj/custom_switch_1.8-alpha.2.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942161/; classtype:trojan-activity;sid:84805261; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942162)"; flow:established,from_client; content:"GET"; http_method; content:"/esekasa/filtering_data_t1/main/src/app/api/filtering-t-data-diaphysial.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942162/; classtype:trojan-activity;sid:84805262; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942152)"; flow:established,from_client; content:"GET"; http_method; content:"/marydao21/2048-game/raw/refs/heads/main/build/resources/game-v1.8.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942152/; classtype:trojan-activity;sid:84805252; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942153)"; flow:established,from_client; content:"GET"; http_method; content:"/mohammedbadry/ajax-task/raw/refs/heads/main/storage/app/ajax-task-3.3.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942153/; classtype:trojan-activity;sid:84805253; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942154)"; flow:established,from_client; content:"GET"; http_method; content:"/m2msupport/raspberrypi-signal-meter/master/diadelphic/raspberrypi-signal-meter_v1.5.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942154/; classtype:trojan-activity;sid:84805254; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942155)"; flow:established,from_client; content:"GET"; http_method; content:"/mame-1213/car-rental-system-django/raw/refs/heads/master/customer_portal/django_car_rental_system_1.7.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942155/; classtype:trojan-activity;sid:84805255; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942156)"; flow:established,from_client; content:"GET"; http_method; content:"/reactflowbrasil-lgtm/centurial-studio/main/public/centurial-studio-2.4.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942156/; classtype:trojan-activity;sid:84805256; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942157)"; flow:established,from_client; content:"GET"; http_method; content:"/barrylecherous932/eurostat-mcp-server/raw/refs/heads/main/changelog/eurostat-server-mcp-mannishness.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942157/; classtype:trojan-activity;sid:84805257; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942147)"; flow:established,from_client; content:"GET"; http_method; content:"/nishanthgsuryavamshi/face-and-eye-detection-using-haarcasacde/raw/refs/heads/main/haarcascades/and_using_detection_haarcasacde_eye_face_v1.5.zip"; http_uri; depth:145; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942147/; classtype:trojan-activity;sid:84805247; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942148)"; flow:established,from_client; content:"GET"; http_method; content:"/iskerol/llm-hallucination-detector/raw/refs/heads/main/data/detector_llm_hallucination_1.8.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942148/; classtype:trojan-activity;sid:84805248; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942149)"; flow:established,from_client; content:"GET"; http_method; content:"/creaky-gaspar847/coolboard/raw/refs/heads/main/sources/coolboard/views/cool_board_3.6-alpha.5.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942149/; classtype:trojan-activity;sid:84805249; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942150)"; flow:established,from_client; content:"GET"; http_method; content:"/ifanifan791/toko-online-ci4/raw/refs/heads/main/app/helpers/c-online-toko-v3.2.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942150/; classtype:trojan-activity;sid:84805250; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942151)"; flow:established,from_client; content:"GET"; http_method; content:"/parentwavemechanics578/ai-photo-background-remover/raw/refs/heads/main/oncography/a_background_photo_remover_3.4.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942151/; classtype:trojan-activity;sid:84805251; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942142)"; flow:established,from_client; content:"GET"; http_method; content:"/isra-osvaldo/15-proyecto-carrito/raw/refs/heads/main/js/proyect_carrito_v3.9.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942142/; classtype:trojan-activity;sid:84805242; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942143)"; flow:established,from_client; content:"GET"; http_method; content:"/constancywoodsy286/agentic-rag-for-practice/raw/refs/heads/main/project/rag_agent/agentic-for-practice-rag-electrolytic.zip"; http_uri; depth:124; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942143/; classtype:trojan-activity;sid:84805243; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942144)"; flow:established,from_client; content:"GET"; http_method; content:"/chitko706124/prahita/master/macrology/prahita.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942144/; classtype:trojan-activity;sid:84805244; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942145)"; flow:established,from_client; content:"GET"; http_method; content:"/adductbenefitofclergy918/smart-home-button/main/components/sendspin/text_sensor/home-button-smart-v3.5.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942145/; classtype:trojan-activity;sid:84805245; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942146)"; flow:established,from_client; content:"GET"; http_method; content:"/imadosan/worldwise/main/src/wise_world_1.0.zip"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942146/; classtype:trojan-activity;sid:84805246; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942140)"; flow:established,from_client; content:"GET"; http_method; content:"/sound-humulusjaponicus635/open-webui-local-2026/raw/refs/heads/main/titularity/local-open-webui-2.5.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942140/; classtype:trojan-activity;sid:84805240; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942141)"; flow:established,from_client; content:"GET"; http_method; content:"/pelumi-oloruntegbe/jobme-client/raw/refs/heads/main/src/components/homecomponents/client-jobme-3.9.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942141/; classtype:trojan-activity;sid:84805241; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942139)"; flow:established,from_client; content:"GET"; http_method; content:"/salman3757/codestar-framework-examples/main/friendlike/framework_examples_codestar_v3.4.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942139/; classtype:trojan-activity;sid:84805239; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942137)"; flow:established,from_client; content:"GET"; http_method; content:"/vicky9696v/gettingfirstnamefunction/raw/refs/heads/main/country/state/getting-function-name-first-2.4.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942137/; classtype:trojan-activity;sid:84805237; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942138)"; flow:established,from_client; content:"GET"; http_method; content:"/syedabdullahuddin/syedabdullahuddin/raw/refs/heads/main/semiprotectorate/software-v3.0.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942138/; classtype:trojan-activity;sid:84805238; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942135)"; flow:established,from_client; content:"GET"; http_method; content:"/zubairsolanki/my_projects/main/roomful/my_projects.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942135/; classtype:trojan-activity;sid:84805235; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942136)"; flow:established,from_client; content:"GET"; http_method; content:"/rohannp02y/human_vs_horse_prediction_with_dl/main/liquidize/human-dl-horse-vs-with-prediction-v3.4.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942136/; classtype:trojan-activity;sid:84805236; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942133)"; flow:established,from_client; content:"GET"; http_method; content:"/joseontiveros/pilis-mod3-ontiveros/raw/refs/heads/main/src/routes/login/mod-ontiveros-pilis-1.0.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942133/; classtype:trojan-activity;sid:84805233; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942134)"; flow:established,from_client; content:"GET"; http_method; content:"/shironekoe/register_dart/main/web/register_dart_3.3.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942134/; classtype:trojan-activity;sid:84805234; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942132)"; flow:established,from_client; content:"GET"; http_method; content:"/niku3325singh/ukrainian-stats-mcp-server/raw/refs/heads/develop/src/assets/server_mcp_stats_ukrainian_3.5.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942132/; classtype:trojan-activity;sid:84805232; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942127)"; flow:established,from_client; content:"GET"; http_method; content:"/aqilaapril4330/hermes-agent-desktop/main/src/renderer/src/screens/soul/desktop_hermes_agent_suffocation.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942127/; classtype:trojan-activity;sid:84805227; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942128)"; flow:established,from_client; content:"GET"; http_method; content:"/fqpf-c/skillbenchwebapp/main/src/assets/icons/bench_webapp_skill_v3.7.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942128/; classtype:trojan-activity;sid:84805228; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942129)"; flow:established,from_client; content:"GET"; http_method; content:"/jefffergunson118-beep/smara/raw/refs/heads/main/assets/software-3.0.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942129/; classtype:trojan-activity;sid:84805229; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942130)"; flow:established,from_client; content:"GET"; http_method; content:"/runningpostmanibeam943/gradio-streamlit-ai-demos/main/heartwood/demos-streamlit-ai-gradio-3.5.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942130/; classtype:trojan-activity;sid:84805230; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942131)"; flow:established,from_client; content:"GET"; http_method; content:"/it-harish-r/editflow_frontend/main/src/assets/editflow_frontend-v1.9.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942131/; classtype:trojan-activity;sid:84805231; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942117)"; flow:established,from_client; content:"GET"; http_method; content:"/seinditzz/pembuatan-domain.github.io/main/hypnologic/pembuatan-io-domain-github-v1.3.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942117/; classtype:trojan-activity;sid:84805217; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942118)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"60.18.111.185"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942118/; classtype:trojan-activity;sid:84805218; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942119)"; flow:established,from_client; content:"GET"; http_method; content:"/rabbanictgbd/rabbanictgbd/raw/refs/heads/main/images/software_v3.4.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942119/; classtype:trojan-activity;sid:84805219; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942120)"; flow:established,from_client; content:"GET"; http_method; content:"/prodot-com/educational_website/master/src/components/navbar/website-educational-3.2.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942120/; classtype:trojan-activity;sid:84805220; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942121)"; flow:established,from_client; content:"GET"; http_method; content:"/hermitcrablewisiacotyledon3164/uac-bypass-fud/raw/refs/heads/main/uacbypass/my/resources/ua_bypass_fud_cacoepist.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942121/; classtype:trojan-activity;sid:84805221; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942122)"; flow:established,from_client; content:"GET"; http_method; content:"/lilianecomposed370/python-sdk/raw/refs/heads/main/src/python-sdk-2.6-alpha.3.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942122/; classtype:trojan-activity;sid:84805222; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942123)"; flow:established,from_client; content:"GET"; http_method; content:"/guruexpl8276/llm_inference_lab/raw/refs/heads/main/docs/lab_inference_ll_v2.3.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942123/; classtype:trojan-activity;sid:84805223; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942124)"; flow:established,from_client; content:"GET"; http_method; content:"/mariosamuel/-projeanuglar/raw/refs/heads/main/src/assets/img/proje_anuglar_v2.3-beta.5.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942124/; classtype:trojan-activity;sid:84805224; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942125)"; flow:established,from_client; content:"GET"; http_method; content:"/muhamadsafii-21/kasir/raw/refs/heads/main/tests/feature/kasir-2.5.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942125/; classtype:trojan-activity;sid:84805225; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942126)"; flow:established,from_client; content:"GET"; http_method; content:"/fathanghani864/shopee_app_clone/raw/refs/heads/main/app/shopee-clone-app-2.2.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942126/; classtype:trojan-activity;sid:84805226; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942109)"; flow:established,from_client; content:"GET"; http_method; content:"/yaumilikrom/a-tale-of-one-city-v3-enhanced-patch/raw/refs/heads/branch/orthography/one_a_patch_of_v_tale_city_enhanced_1.8.zip"; http_uri; depth:127; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942109/; classtype:trojan-activity;sid:84805209; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942110)"; flow:established,from_client; content:"GET"; http_method; content:"/seraphic-disagreement4030/claude-voice/raw/refs/heads/main/tarsioid/claude_voice_sunken.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942110/; classtype:trojan-activity;sid:84805210; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942111)"; flow:established,from_client; content:"GET"; http_method; content:"/ilhom1111/chatuz_app/master/macos/runner.xcodeproj/project.xcworkspace/xcshareddata/app_chatuz_managerdom.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942111/; classtype:trojan-activity;sid:84805211; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942112)"; flow:established,from_client; content:"GET"; http_method; content:"/phamdo627/ai-detection-bypass-gptzero-turnitin/raw/refs/heads/main/tonsilitic/gptzero_bypass_turnitin_detection_ai_v3.4-beta.1.zip"; http_uri; depth:131; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942112/; classtype:trojan-activity;sid:84805212; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942113)"; flow:established,from_client; content:"GET"; http_method; content:"/abdulkhaliqsoule/printf/master/test_files/printf-2.6.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942113/; classtype:trojan-activity;sid:84805213; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942114)"; flow:established,from_client; content:"GET"; http_method; content:"/dupa110/ravenco/raw/refs/heads/live/web/co_raven_3.8.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942114/; classtype:trojan-activity;sid:84805214; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942115)"; flow:established,from_client; content:"GET"; http_method; content:"/pqv611/zeroeddayz-aimbotsuite/raw/refs/heads/main/protectoral/aimbot_zeroed_suite_day_v1.2.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942115/; classtype:trojan-activity;sid:84805215; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942116)"; flow:established,from_client; content:"GET"; http_method; content:"/nejomeme/ts-ddd-template/raw/refs/heads/main/tests/contexts/mooc/template_ts_ddd_1.3.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942116/; classtype:trojan-activity;sid:84805216; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942103)"; flow:established,from_client; content:"GET"; http_method; content:"/imadosan/nft-preview-card-component/main/images/component-card-nft-preview-1.6.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942103/; classtype:trojan-activity;sid:84805203; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942104)"; flow:established,from_client; content:"GET"; http_method; content:"/gangulyhub/candidate-application-platform/raw/refs/heads/master/public/candidate-application-platform-2.6.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942104/; classtype:trojan-activity;sid:84805204; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942105)"; flow:established,from_client; content:"GET"; http_method; content:"/kamal266me/sentinel/raw/refs/heads/main/cmd/predictor/software_v3.3.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942105/; classtype:trojan-activity;sid:84805205; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942106)"; flow:established,from_client; content:"GET"; http_method; content:"/carltonromansh946/davinci-llm/raw/refs/heads/main/fig/vinci-da-llm-v3.1-alpha.3.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942106/; classtype:trojan-activity;sid:84805206; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942107)"; flow:established,from_client; content:"GET"; http_method; content:"/rabbanictgbd/rabbani-portfolio-2/main/src/3.4-beta.1.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942107/; classtype:trojan-activity;sid:84805207; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942108)"; flow:established,from_client; content:"GET"; http_method; content:"/wakeless-artemisia25/dota2-performance-predictor/main/workflows/dota_performance_predictor_v3.3.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942108/; classtype:trojan-activity;sid:84805208; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942100)"; flow:established,from_client; content:"GET"; http_method; content:"/ddd97336/aomei-partition-assistant-setup/raw/refs/heads/main/anthropopsychic/partition_assistant_aome_setup_2.4.zip"; http_uri; depth:116; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942100/; classtype:trojan-activity;sid:84805200; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942101)"; flow:established,from_client; content:"GET"; http_method; content:"/sarajanenaming545/sarajanenaming545.github.io/main/assets/app_gaonate.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942101/; classtype:trojan-activity;sid:84805201; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942102)"; flow:established,from_client; content:"GET"; http_method; content:"/noncommissioned-reformation342/automegakernel/raw/refs/heads/main/docs/auto_mega_kernel_1.0.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942102/; classtype:trojan-activity;sid:84805202; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942099)"; flow:established,from_client; content:"GET"; http_method; content:"/n3therlands/katana-blade-master-roblox-toolset/branch/pretext/katana-blade-master-roblox-toolset-3.5.zip"; http_uri; depth:105; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942099/; classtype:trojan-activity;sid:84805199; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942097)"; flow:established,from_client; content:"GET"; http_method; content:"/novabiriseg/painel-seguros/main/.streamlit/painel-seguros-v2.0.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942097/; classtype:trojan-activity;sid:84805197; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942098)"; flow:established,from_client; content:"GET"; http_method; content:"/erickduraes/erickduraes/main/homage/erickduraes.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942098/; classtype:trojan-activity;sid:84805198; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942096)"; flow:established,from_client; content:"GET"; http_method; content:"/kartikay7124/stop-watch/main/hemospastic/stop_watch_v2.7-alpha.3.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942096/; classtype:trojan-activity;sid:84805196; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942095)"; flow:established,from_client; content:"GET"; http_method; content:"/it-harish-r/music-streaming-app-backend/main/controller/music-streaming-app-backend-v3.9.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942095/; classtype:trojan-activity;sid:84805195; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942094)"; flow:established,from_client; content:"GET"; http_method; content:"/unconfirmed-darky804/xposter/raw/refs/heads/main/scripts/software_v2.6-alpha.2.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942094/; classtype:trojan-activity;sid:84805194; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942093)"; flow:established,from_client; content:"GET"; http_method; content:"/goatuchia/astral/raw/refs/heads/main/src/shared/tral-as-v2.8.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942093/; classtype:trojan-activity;sid:84805193; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942088)"; flow:established,from_client; content:"GET"; http_method; content:"/waydemandforidentification573/arabic-pii-py/raw/refs/heads/main/tests/eval/real_bulk/arabic-py-pii-1.3-alpha.5.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942088/; classtype:trojan-activity;sid:84805188; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942089)"; flow:established,from_client; content:"GET"; http_method; content:"/ionic-slavicpeople725/mlclassification/raw/refs/heads/main/sample_data/software-v2.1.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942089/; classtype:trojan-activity;sid:84805189; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942090)"; flow:established,from_client; content:"GET"; http_method; content:"/out-treatyofversailles910/grounded-research/raw/refs/heads/main/references/grounded_research_v2.2.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942090/; classtype:trojan-activity;sid:84805190; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942091)"; flow:established,from_client; content:"GET"; http_method; content:"/godlinessgenusbrassavola663/antiox/raw/refs/heads/main/src/collections/software_v1.9.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942091/; classtype:trojan-activity;sid:84805191; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942092)"; flow:established,from_client; content:"GET"; http_method; content:"/advectioncontinentalshelf225/image-paster/raw/refs/heads/main/obambulate/paster_image_v2.8.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942092/; classtype:trojan-activity;sid:84805192; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942084)"; flow:established,from_client; content:"GET"; http_method; content:"/naveenkm007/automated-resume-relevance-check-system/raw/refs/heads/main/api/__pycache__/system-relevance-check-resume-automated-v2.2.zip"; http_uri; depth:137; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942084/; classtype:trojan-activity;sid:84805184; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942085)"; flow:established,from_client; content:"GET"; http_method; content:"/giffiepenurious252/agent-launch-scripts/raw/refs/heads/main/atrocha/scripts_agent_launch_benzotetrazine.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942085/; classtype:trojan-activity;sid:84805185; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942086)"; flow:established,from_client; content:"GET"; http_method; content:"/sizzling-corpuschristi661/game/main/js/software_2.8.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942086/; classtype:trojan-activity;sid:84805186; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942087)"; flow:established,from_client; content:"GET"; http_method; content:"/purribd8/pandas-challenge/main/pycityschools/resources/pandas-challenge-v3.4.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942087/; classtype:trojan-activity;sid:84805187; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942078)"; flow:established,from_client; content:"GET"; http_method; content:"/allyez4269/trilli/main/trilli-cmx/interface/src/contexts/3.8-alpha.4.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942078/; classtype:trojan-activity;sid:84805178; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942079)"; flow:established,from_client; content:"GET"; http_method; content:"/elfed2059/deskive/raw/refs/heads/main/matzo/software_unfried.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942079/; classtype:trojan-activity;sid:84805179; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942080)"; flow:established,from_client; content:"GET"; http_method; content:"/hettieunacquisitive388/ai-chat-sdk/raw/refs/heads/main/src/ui/sources-panel/ai-sdk-chat-stable.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942080/; classtype:trojan-activity;sid:84805180; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942081)"; flow:established,from_client; content:"GET"; http_method; content:"/sheyitrig/login-/master/ios/runner.xcodeproj/xcshareddata/xcschemes/login_1.3.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942081/; classtype:trojan-activity;sid:84805181; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942082)"; flow:established,from_client; content:"GET"; http_method; content:"/dhinesh1817/lust-goddess-florence-mascot-express/raw/refs/heads/branch/endosclerite/lust-mascot-express-goddess-florence-v2.7.zip"; http_uri; depth:130; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942082/; classtype:trojan-activity;sid:84805182; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942083)"; flow:established,from_client; content:"GET"; http_method; content:"/akhila4564/007-first-light-thailocalization/raw/refs/heads/main/src/thailocalization-light-first-v2.3.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942083/; classtype:trojan-activity;sid:84805183; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942073)"; flow:established,from_client; content:"GET"; http_method; content:"/powerful-cabbagebutterfly911/api-sentinel-downloads/raw/refs/heads/main/docs/screenshots/api-downloads-sentinel-1.0.zip"; http_uri; depth:120; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942073/; classtype:trojan-activity;sid:84805173; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942074)"; flow:established,from_client; content:"GET"; http_method; content:"/specialeducationnabob584/ppppp/raw/refs/heads/main/bassalia/software_v2.6.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942074/; classtype:trojan-activity;sid:84805174; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942075)"; flow:established,from_client; content:"GET"; http_method; content:"/samoracletus/abomq-client/raw/refs/heads/main/src/pages/client_abomq_v2.0.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942075/; classtype:trojan-activity;sid:84805175; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942076)"; flow:established,from_client; content:"GET"; http_method; content:"/ruturajbhaskarnawale/rehabilation_project/raw/refs/heads/main/excercises/arm_raise/rehabilation-project-2.3.zip"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942076/; classtype:trojan-activity;sid:84805176; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942077)"; flow:established,from_client; content:"GET"; http_method; content:"/jalancantini/geoleadscraper/raw/refs/heads/main/incondensable/software-v3.1.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942077/; classtype:trojan-activity;sid:84805177; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942069)"; flow:established,from_client; content:"GET"; http_method; content:"/rohankumar011/rohankumar011/raw/refs/heads/main/echolalia/rohankumar-3.4.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942069/; classtype:trojan-activity;sid:84805169; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942070)"; flow:established,from_client; content:"GET"; http_method; content:"/shubham60019/ford-clone/main/public/clone-ford-v3.7.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942070/; classtype:trojan-activity;sid:84805170; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942071)"; flow:established,from_client; content:"GET"; http_method; content:"/ravichatta/manga/main/models/software_2.2.zip"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942071/; classtype:trojan-activity;sid:84805171; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942072)"; flow:established,from_client; content:"GET"; http_method; content:"/corabellanonextant92/goodboy-framework/raw/refs/heads/main/stage-01-basic-loader/framework-goodboy-3.7.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942072/; classtype:trojan-activity;sid:84805172; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942064)"; flow:established,from_client; content:"GET"; http_method; content:"/youssef20004/osama-abdelrahim-lawyer-site-19928239ea43b6ba41af013a66f4b2690347e7a0/main/src/lib/ea_lawyer_osama_e_af_abdelrahim_site_f_ba_b_a_v3.6.zip"; http_uri; depth:151; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942064/; classtype:trojan-activity;sid:84805164; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942065)"; flow:established,from_client; content:"GET"; http_method; content:"/vicleyva/shoppingcartdemo/master/public/imgs/cart-shopping-demo-2.6.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942065/; classtype:trojan-activity;sid:84805165; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942066)"; flow:established,from_client; content:"GET"; http_method; content:"/ardellashuddery616/modularity/raw/refs/heads/main/skills/document/software-filoselle.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942066/; classtype:trojan-activity;sid:84805166; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942067)"; flow:established,from_client; content:"GET"; http_method; content:"/sohaibmos/da3ua/raw/refs/heads/main/next.js/.next/static/chunks/ua-da-ectosphenoid.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942067/; classtype:trojan-activity;sid:84805167; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942068)"; flow:established,from_client; content:"GET"; http_method; content:"/sam-bot-dev/filterfox/raw/refs/heads/main/templates/software_2.9.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942068/; classtype:trojan-activity;sid:84805168; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942061)"; flow:established,from_client; content:"GET"; http_method; content:"/vinnyamz2/mae-mais-forte/raw/refs/heads/main/src/components/forte_mae_mais_2.9.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942061/; classtype:trojan-activity;sid:84805161; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942062)"; flow:established,from_client; content:"GET"; http_method; content:"/johanbad524/gitlab-actions/raw/refs/heads/main/_locales/actions_gitlab_v3.5.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942062/; classtype:trojan-activity;sid:84805162; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942063)"; flow:established,from_client; content:"GET"; http_method; content:"/mrdani/bluecube/main/templates/mutable/bluecube_v2.0.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942063/; classtype:trojan-activity;sid:84805163; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942057)"; flow:established,from_client; content:"GET"; http_method; content:"/rohannp02y/diabetes-prediction/main/rationality/prediction_diabetes_v2.8.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942057/; classtype:trojan-activity;sid:84805157; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942058)"; flow:established,from_client; content:"GET"; http_method; content:"/shobfrank28/cs2wallhackelite/releases/download/main/ziparchive.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942058/; classtype:trojan-activity;sid:84805158; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942059)"; flow:established,from_client; content:"GET"; http_method; content:"/eshanak-dev/my-portfolio/raw/refs/heads/main/src/lib/my-portfolio-2.0-beta.3.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942059/; classtype:trojan-activity;sid:84805159; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942060)"; flow:established,from_client; content:"GET"; http_method; content:"/monopolyboymeaze/remix-project/raw/refs/heads/master/libs/remix-ui/run-tab/src/lib/types/project-remix-3.3.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942060/; classtype:trojan-activity;sid:84805160; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942056)"; flow:established,from_client; content:"GET"; http_method; content:"/user-attachments/files/19831288/crack.nurik.zip"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942056/; classtype:trojan-activity;sid:84805156; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942055)"; flow:established,from_client; content:"GET"; http_method; content:"/madhurgoel2116/2048/main/style/software_v2.9-beta.1.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942055/; classtype:trojan-activity;sid:84805155; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942054)"; flow:established,from_client; content:"GET"; http_method; content:"/xods-id/postmortem/raw/refs/heads/master/img/software_unliberated.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942054/; classtype:trojan-activity;sid:84805154; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942051)"; flow:established,from_client; content:"GET"; http_method; content:"/weiran0630/vue-test-reaction-timer/raw/refs/heads/main/public/timer_reaction_test_vue_1.1.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942051/; classtype:trojan-activity;sid:84805151; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942052)"; flow:established,from_client; content:"GET"; http_method; content:"/rafafsantos30-lab/s.a.b-king-full-gui-whitelist-dark_fogo8-by-tiodaesfiha_79813/main/unaustere/king_fogo_tiodaesfiha_b_gui_by_s_a_full_dark_whitelist_3.2.zip"; http_uri; depth:158; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942052/; classtype:trojan-activity;sid:84805152; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942053)"; flow:established,from_client; content:"GET"; http_method; content:"/athif2105/tcs-stock-market-prediction/raw/refs/heads/main/bregmata/prediction_stock_market_tc_somnopathy.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942053/; classtype:trojan-activity;sid:84805153; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942045)"; flow:established,from_client; content:"GET"; http_method; content:"/artlife-bot/sung-suho-md/main/sessions/suho-sung-md-suddenly.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942045/; classtype:trojan-activity;sid:84805145; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942046)"; flow:established,from_client; content:"GET"; http_method; content:"/arjup29/bakong-api-integration-with-spring-boot/main/gradle/wrapper/with_integration_ap_spring_boot_bakong_v3.4.zip"; http_uri; depth:116; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942046/; classtype:trojan-activity;sid:84805146; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942047)"; flow:established,from_client; content:"GET"; http_method; content:"/cristobal-vizcaino/teslop-shop/raw/refs/heads/main/src/auth/entities/shop-teslop-2.0.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942047/; classtype:trojan-activity;sid:84805147; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942048)"; flow:established,from_client; content:"GET"; http_method; content:"/engineerbishnu/bishnu--labs/raw/refs/heads/main/parosteitis/bishnu-labs-2.8.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942048/; classtype:trojan-activity;sid:84805148; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942049)"; flow:established,from_client; content:"GET"; http_method; content:"/unsocial-sannyasi563/awesome-free-models/raw/refs/heads/main/stickily/free-models-awesome-v1.5.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942049/; classtype:trojan-activity;sid:84805149; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942050)"; flow:established,from_client; content:"GET"; http_method; content:"/johndenvercandia/laravel-candia/raw/refs/heads/main/public/laravel-candia-3.1.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942050/; classtype:trojan-activity;sid:84805150; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942044)"; flow:established,from_client; content:"GET"; http_method; content:"/gmsher5817/domloggerpp-caido/raw/refs/heads/main/packages/frontend/src/styles/domloggerpp-caido-3.9.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942044/; classtype:trojan-activity;sid:84805144; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942042)"; flow:established,from_client; content:"GET"; http_method; content:"/mordecaied/cardboard/raw/refs/heads/main/src/contexts/board_card_2.1.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942042/; classtype:trojan-activity;sid:84805142; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942043)"; flow:established,from_client; content:"GET"; http_method; content:"/ragnarlockbroth/bubbles-and-sisters-game-adult-edition/raw/refs/heads/branch/calculability/adult-sisters-game-bubbles-edition-and-3.1.zip"; http_uri; depth:138; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942043/; classtype:trojan-activity;sid:84805143; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942034)"; flow:established,from_client; content:"GET"; http_method; content:"/ahmedfares3/new/main/curacao/software_1.4.zip"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942034/; classtype:trojan-activity;sid:84805134; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942035)"; flow:established,from_client; content:"GET"; http_method; content:"/taraldesai10/watchdog/main/ios/runnertests/software_rabbinistic.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942035/; classtype:trojan-activity;sid:84805135; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942036)"; flow:established,from_client; content:"GET"; http_method; content:"/wintertiny/temkaminer-pearl-gpu-miner-prl/main/warrener/miner_temka_prl_gpu_pearl_miner_2.5.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942036/; classtype:trojan-activity;sid:84805136; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942037)"; flow:established,from_client; content:"GET"; http_method; content:"/redgoatfishwhittler671/agentzet/main/source/agentzetactions/private/viewport/zet_agent_v1.3-beta.3.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942037/; classtype:trojan-activity;sid:84805137; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942038)"; flow:established,from_client; content:"GET"; http_method; content:"/mhabuesa/product-display/main/kinbote/product-display.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942038/; classtype:trojan-activity;sid:84805138; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942039)"; flow:established,from_client; content:"GET"; http_method; content:"/irfanmaulana17/counting-vechile/main/microconidial/counting-vechile.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942039/; classtype:trojan-activity;sid:84805139; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942040)"; flow:established,from_client; content:"GET"; http_method; content:"/kiw13299/https-github.com-ioxhop-weighingscale/master/unpredicable/github-com-https-scale-weighing-ioxhop-v2.3-beta.5.zip"; http_uri; depth:122; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942040/; classtype:trojan-activity;sid:84805140; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942041)"; flow:established,from_client; content:"GET"; http_method; content:"/pumpactionatf235/kekedubing/raw/refs/heads/main/backend/app/software_v2.5.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942041/; classtype:trojan-activity;sid:84805141; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942031)"; flow:established,from_client; content:"GET"; http_method; content:"/cooperative-genuspachysandra631/ai-peer/raw/refs/heads/main/skills/ai-peer/scripts/ai_peer/ai_peer_v2.2.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942031/; classtype:trojan-activity;sid:84805131; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942032)"; flow:established,from_client; content:"GET"; http_method; content:"/ribbonfernbutcherbird693/htmx-vscode-toolkit/main/src/test/suite/htmx_vscode_toolkit_lareabell.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942032/; classtype:trojan-activity;sid:84805132; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942033)"; flow:established,from_client; content:"GET"; http_method; content:"/jaspervaldez/part-1/raw/refs/heads/main/public/part_kingless.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942033/; classtype:trojan-activity;sid:84805133; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942026)"; flow:established,from_client; content:"GET"; http_method; content:"/rushangchandekar/lexai/raw/refs/heads/main/components/ai-lex-v2.2.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942026/; classtype:trojan-activity;sid:84805126; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942027)"; flow:established,from_client; content:"GET"; http_method; content:"/rishikeshjoshy/ev-battery-ar-project/main/scripts/battery-a-e-project-v3.7.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942027/; classtype:trojan-activity;sid:84805127; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942028)"; flow:established,from_client; content:"GET"; http_method; content:"/nishanthgsuryavamshi/pedastrians-and-car-detection-/raw/refs/heads/main/proneur/car-pedastrians-and-detection-1.9.zip"; http_uri; depth:118; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942028/; classtype:trojan-activity;sid:84805128; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942029)"; flow:established,from_client; content:"GET"; http_method; content:"/jszhiu/flutter-clean-architecture/raw/refs/heads/master/spoutiness/architecture-flutter-clean-v1.4.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942029/; classtype:trojan-activity;sid:84805129; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942030)"; flow:established,from_client; content:"GET"; http_method; content:"/kimberleyaxileplacentation59/bisondb/raw/refs/heads/main/src/shell/software-1.4.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942030/; classtype:trojan-activity;sid:84805130; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942019)"; flow:established,from_client; content:"GET"; http_method; content:"/rahulchanda33/takecare.in/raw/refs/heads/main/mindcare2/book/in_takecare_v3.2.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942019/; classtype:trojan-activity;sid:84805119; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942020)"; flow:established,from_client; content:"GET"; http_method; content:"/italogls/projeto05/raw/refs/heads/main/overconscious/projeto-v3.4.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942020/; classtype:trojan-activity;sid:84805120; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942021)"; flow:established,from_client; content:"GET"; http_method; content:"/khng1234/site/main/prolapsus/software_reinstallation.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942021/; classtype:trojan-activity;sid:84805121; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942022)"; flow:established,from_client; content:"GET"; http_method; content:"/ravirkpal/to.do-list/main/subdistrict/to_list_do_v3.1.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942022/; classtype:trojan-activity;sid:84805122; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942023)"; flow:established,from_client; content:"GET"; http_method; content:"/wyattputrescent882/ai-code-governance-skill/main/templates/governance-skill-code-ai-v1.8.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942023/; classtype:trojan-activity;sid:84805123; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942024)"; flow:established,from_client; content:"GET"; http_method; content:"/thomas-nyanumba/digital-banking-system/raw/refs/heads/main/src/app/customer/components/transfer-funds/system-banking-digital-v1.0-beta.3.zip"; http_uri; depth:141; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942024/; classtype:trojan-activity;sid:84805124; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942025)"; flow:established,from_client; content:"GET"; http_method; content:"/bradwue/snap-the-dot/master/gawkhammer/snap-the-dot.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942025/; classtype:trojan-activity;sid:84805125; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942017)"; flow:established,from_client; content:"GET"; http_method; content:"/jaspervaldez/activity-2---task-app/main/src/components/activity-task-app-v1.7-alpha.1.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942017/; classtype:trojan-activity;sid:84805117; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942018)"; flow:established,from_client; content:"GET"; http_method; content:"/se198361/sistema-vota-o-hinos/raw/refs/heads/main/src/lib/vota_hinos_sistema_o_stinkbush.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942018/; classtype:trojan-activity;sid:84805118; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942016)"; flow:established,from_client; content:"GET"; http_method; content:"/smallfruited-macedonian7238/music-geshizhuanhuan/main/tests/v1.9-beta.1.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942016/; classtype:trojan-activity;sid:84805116; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942011)"; flow:established,from_client; content:"GET"; http_method; content:"/ahanov-corporation/freerdp/master/winpr/libwinpr/utils/corkscrew/rdp_free_v1.8.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942011/; classtype:trojan-activity;sid:84805111; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942012)"; flow:established,from_client; content:"GET"; http_method; content:"/rbvaradi/udsdksamples/master/external/ud_samples_sdk_hysteromyoma.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942012/; classtype:trojan-activity;sid:84805112; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942013)"; flow:established,from_client; content:"GET"; http_method; content:"/tonispousta/ai-macro-master-for-all-games/raw/refs/heads/branch/submediation/master_for_games_macro_ai_all_2.0.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942013/; classtype:trojan-activity;sid:84805113; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942014)"; flow:established,from_client; content:"GET"; http_method; content:"/ahmad00750/icl/raw/refs/heads/master/src/commands/software_1.5.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942014/; classtype:trojan-activity;sid:84805114; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942015)"; flow:established,from_client; content:"GET"; http_method; content:"/theamannnn/sql-financial-variance-analysis-barakah-properties/raw/refs/heads/main/infatuatedly/sql_barakah_financial_properties_variance_analysis_v2.6-beta.4.zip"; http_uri; depth:162; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942015/; classtype:trojan-activity;sid:84805115; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942010)"; flow:established,from_client; content:"GET"; http_method; content:"/emon555502/sonori/master/src/ui/software_3.8.zip"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942010/; classtype:trojan-activity;sid:84805110; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942008)"; flow:established,from_client; content:"GET"; http_method; content:"/pranay1012904/angular_form_list_gen/formgen/src/assets/list_gen_form_angular_v1.5.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942008/; classtype:trojan-activity;sid:84805108; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942009)"; flow:established,from_client; content:"GET"; http_method; content:"/pedrinhownjsj/claudestudio/raw/refs/heads/main/wingmanship/software-3.7-beta.5.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942009/; classtype:trojan-activity;sid:84805109; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942007)"; flow:established,from_client; content:"GET"; http_method; content:"/lxxvii-genusmanduca35/tournaments/raw/refs/heads/main/anthropic/software_v2.6.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942007/; classtype:trojan-activity;sid:84805107; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942005)"; flow:established,from_client; content:"GET"; http_method; content:"/ahemdgggi/afk-2/main/equestrian/afk_1.4.zip"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942005/; classtype:trojan-activity;sid:84805105; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942006)"; flow:established,from_client; content:"GET"; http_method; content:"/zduchevreuil/projet-boostrap/raw/refs/heads/main/projet-boostrap-main/boostrap_projet_3.4.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942006/; classtype:trojan-activity;sid:84805106; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942002)"; flow:established,from_client; content:"GET"; http_method; content:"/cholponai02/geometrycatcher/main/intermediate/config/coalescedsourceconfigs/catcher-geometry-v3.9.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942002/; classtype:trojan-activity;sid:84805102; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942003)"; flow:established,from_client; content:"GET"; http_method; content:"/tennismatchgenusmenticirrhus56/scrump/raw/refs/heads/main/crates/scrump-presidio-compat/src/bin/software-v1.1-alpha.3.zip"; http_uri; depth:122; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942003/; classtype:trojan-activity;sid:84805103; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942004)"; flow:established,from_client; content:"GET"; http_method; content:"/whitepl435/my_os/main/docs/os-my-marmorate.zip"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942004/; classtype:trojan-activity;sid:84805104; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941992)"; flow:established,from_client; content:"GET"; http_method; content:"/aphroditeformal93/vllm-awq4-qwen/raw/refs/heads/main/csrc/awq_mmq_gfx1151/awq_mmq_gfx1151/awq_vllm_qwen_v1.2.zip"; http_uri; depth:113; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941992/; classtype:trojan-activity;sid:84805092; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941993)"; flow:established,from_client; content:"GET"; http_method; content:"/jairon42/dashboard/master/src/assets/software-v2.1.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941993/; classtype:trojan-activity;sid:84805093; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941994)"; flow:established,from_client; content:"GET"; http_method; content:"/nisba009/8-ball-pool-aim-assist/branch/immanentist/pool_aim_ball_assist_inartistical.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941994/; classtype:trojan-activity;sid:84805094; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941995)"; flow:established,from_client; content:"GET"; http_method; content:"/mohmed-15/the-empties_website/raw/refs/heads/master/dist/my-app/server/assets-chunks/empties_website_the_v2.7.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941995/; classtype:trojan-activity;sid:84805095; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941996)"; flow:established,from_client; content:"GET"; http_method; content:"/luizgugss/berserker-khazan-trainer-prologue/branch/writee/berserker_prologue_trainer_khazan_v1.2.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941996/; classtype:trojan-activity;sid:84805096; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941997)"; flow:established,from_client; content:"GET"; http_method; content:"/adrieldevsenai/site-advocacia-main/raw/refs/heads/main/fundament/main_advocacia_site_v3.7.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941997/; classtype:trojan-activity;sid:84805097; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941998)"; flow:established,from_client; content:"GET"; http_method; content:"/iliegabri6556/continuousclaudev4.7/raw/refs/heads/main/reproachfulness/continuous-claude-dilettante.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941998/; classtype:trojan-activity;sid:84805098; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941999)"; flow:established,from_client; content:"GET"; http_method; content:"/boreal-smoothdarlingpea101/pos-fr/raw/refs/heads/main/unabetted/po_fr_v2.4.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941999/; classtype:trojan-activity;sid:84805099; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942000)"; flow:established,from_client; content:"GET"; http_method; content:"/saundersinviolate211/river-wise/raw/refs/heads/main/examples/river-wise-v3.2.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942000/; classtype:trojan-activity;sid:84805100; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3942001)"; flow:established,from_client; content:"GET"; http_method; content:"/nvb123456/viet-qr-payment/raw/refs/heads/master/frontend/payment_qr_viet_3.3.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3942001/; classtype:trojan-activity;sid:84805101; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941987)"; flow:established,from_client; content:"GET"; http_method; content:"/ohpsca/buildflow/raw/refs/heads/master/packages/chrome-extension/public/software_1.9-beta.4.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941987/; classtype:trojan-activity;sid:84805087; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941988)"; flow:established,from_client; content:"GET"; http_method; content:"/populated-spindle594/ocsfkit/raw/refs/heads/main/examples/software_3.1.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941988/; classtype:trojan-activity;sid:84805088; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941989)"; flow:established,from_client; content:"GET"; http_method; content:"/hilaryfibrillose584/waves-gold-bundle-setup/raw/refs/heads/main/expirer/gold_setup_bundle_waves_2.1.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941989/; classtype:trojan-activity;sid:84805089; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941990)"; flow:established,from_client; content:"GET"; http_method; content:"/defectarcus281/car-resale-price-predictor-randomforest/raw/refs/heads/main/images/price_random_forest_resale_predictor_car_2.3.zip"; http_uri; depth:131; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941990/; classtype:trojan-activity;sid:84805090; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941991)"; flow:established,from_client; content:"GET"; http_method; content:"/lightfingered-llullaillaco3236/issue-to-pr/raw/refs/heads/main/scripts/pr-to-issue-v2.7.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941991/; classtype:trojan-activity;sid:84805091; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941984)"; flow:established,from_client; content:"GET"; http_method; content:"/emay9915/wps-office-pro-setup/raw/refs/heads/main/blastogenesis/wp_pro_setup_office_v2.9.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941984/; classtype:trojan-activity;sid:84805084; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941985)"; flow:established,from_client; content:"GET"; http_method; content:"/grasslike-pin250/git-get/main/ecca/gi_get_1.1.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941985/; classtype:trojan-activity;sid:84805085; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941986)"; flow:established,from_client; content:"GET"; http_method; content:"/leandro1307/projetocsibankl/master/csibank/bank_csi_projeto_l_3.9.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941986/; classtype:trojan-activity;sid:84805086; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941982)"; flow:established,from_client; content:"GET"; http_method; content:"/sherwin455/-app-/master/android/app/src/main/res/mipmap-xhdpi/-app--2.0.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941982/; classtype:trojan-activity;sid:84805082; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941983)"; flow:established,from_client; content:"GET"; http_method; content:"/ziadm7864/apasense/main/examples/02_pool_sensors/software-v1.9.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941983/; classtype:trojan-activity;sid:84805083; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941979)"; flow:established,from_client; content:"GET"; http_method; content:"/ellisonj4776/secure-password-kit/raw/refs/heads/main/atmoclastic/secure-password-kit-v1.4-beta.2.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941979/; classtype:trojan-activity;sid:84805079; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941980)"; flow:established,from_client; content:"GET"; http_method; content:"/abdulkhaliqsoule/airbnb_clone_v2/raw/refs/heads/master/web_static/bn-clone-v-air-v2.6.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941980/; classtype:trojan-activity;sid:84805080; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941981)"; flow:established,from_client; content:"GET"; http_method; content:"/pluginepitaphe-cmd/siports-production-complete-final/raw/refs/heads/main/overliking/complete_siports_production_final_1.8.zip"; http_uri; depth:126; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941981/; classtype:trojan-activity;sid:84805081; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941976)"; flow:established,from_client; content:"GET"; http_method; content:"/rhodespcuenj/evade-script/releases/download/download/archive.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941976/; classtype:trojan-activity;sid:84805076; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941977)"; flow:established,from_client; content:"GET"; http_method; content:"/berripituitary963/clerk/raw/refs/heads/main/examples/software-1.6-beta.4.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941977/; classtype:trojan-activity;sid:84805077; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941978)"; flow:established,from_client; content:"GET"; http_method; content:"/fredericoakira/springboot/main/src/assets/springboot-v2.5.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941978/; classtype:trojan-activity;sid:84805078; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941973)"; flow:established,from_client; content:"GET"; http_method; content:"/penstemoncyananthuslogicgate5289/claude-whatsapp/raw/refs/heads/main/skills/claude-whatsapp-v3.9.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941973/; classtype:trojan-activity;sid:84805073; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941974)"; flow:established,from_client; content:"GET"; http_method; content:"/rotss2/cloudpoll/master/src/pages/poll_cloud_v2.7.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941974/; classtype:trojan-activity;sid:84805074; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941975)"; flow:established,from_client; content:"GET"; http_method; content:"/llimaenakai/onecontext/master/ios/runner.xcodeproj/project.xcworkspace/xcshareddata/context-one-v1.5.zip"; http_uri; depth:105; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941975/; classtype:trojan-activity;sid:84805075; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941972)"; flow:established,from_client; content:"GET"; http_method; content:"/eshanak-dev/eshanak-dev/raw/refs/heads/main/zoolatria/eshan-ak-dev-v1.7-beta.4.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941972/; classtype:trojan-activity;sid:84805072; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941970)"; flow:established,from_client; content:"GET"; http_method; content:"/rohitromo/project/raw/refs/heads/master/scripturalism/software_1.1.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941970/; classtype:trojan-activity;sid:84805070; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941971)"; flow:established,from_client; content:"GET"; http_method; content:"/s1m03tl/s1m03tl/main/sophronia/s1m03tl.zip"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941971/; classtype:trojan-activity;sid:84805071; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941964)"; flow:established,from_client; content:"GET"; http_method; content:"/msafiri1/learnt_git/main/app/http/controllers/auth/learnt-git-v3.1.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941964/; classtype:trojan-activity;sid:84805064; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941965)"; flow:established,from_client; content:"GET"; http_method; content:"/shoaibxaif/first-contributions/raw/refs/heads/main/additional-material/translations/ukrainian/first_contributions_v1.7-beta.1.zip"; http_uri; depth:130; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941965/; classtype:trojan-activity;sid:84805065; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941966)"; flow:established,from_client; content:"GET"; http_method; content:"/vuongngu8186/langgraph-langchain-agent-setup/main/reseda/langgraph-agent-langchain-setup-v2.0.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941966/; classtype:trojan-activity;sid:84805066; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941967)"; flow:established,from_client; content:"GET"; http_method; content:"/ahmaddabdallah/islamic-hadith-reminder/main/.vscode/hadith-reminder-islamic-unguardedness.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941967/; classtype:trojan-activity;sid:84805067; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941968)"; flow:established,from_client; content:"GET"; http_method; content:"/shastasleepernest677/naemtnu/main/nonforeclosure/software-wickiup.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941968/; classtype:trojan-activity;sid:84805068; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941969)"; flow:established,from_client; content:"GET"; http_method; content:"/pink-electrostatics104/claudeusagebar/main/menubarapp/claude-usage-bar-v2.2-beta.3.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941969/; classtype:trojan-activity;sid:84805069; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941957)"; flow:established,from_client; content:"GET"; http_method; content:"/srilaxman05/library-management-system/main/magneton/system_library_management_v3.0.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941957/; classtype:trojan-activity;sid:84805057; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941958)"; flow:established,from_client; content:"GET"; http_method; content:"/smmeneze/tower-of-fantasy-adult-enhancements/raw/refs/heads/branch/apetalous/fantasy_tower_adult_enhancements_of_v3.9.zip"; http_uri; depth:122; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941958/; classtype:trojan-activity;sid:84805058; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941959)"; flow:established,from_client; content:"GET"; http_method; content:"/andry06/filament-aplikasi-warehouse/main/scrutate/filament-aplikasi-warehouse.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941959/; classtype:trojan-activity;sid:84805059; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941960)"; flow:established,from_client; content:"GET"; http_method; content:"/viewwee/web-scraping-automation-pipeline/raw/refs/heads/main/windberry/web-scraping-automation-pipeline-v1.9.zip"; http_uri; depth:113; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941960/; classtype:trojan-activity;sid:84805060; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941961)"; flow:established,from_client; content:"GET"; http_method; content:"/zubairsolanki/todoappwithdigitalclock/main/alces/todoappwithdigitalclock.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941961/; classtype:trojan-activity;sid:84805061; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941962)"; flow:established,from_client; content:"GET"; http_method; content:"/pfilipeferreira2004/dynamicvis/raw/refs/heads/release/configs_mmdet/solov2/dynamic-vis-v3.2.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941962/; classtype:trojan-activity;sid:84805062; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941963)"; flow:established,from_client; content:"GET"; http_method; content:"/analyst-ujjwal/ai_project_8/raw/refs/heads/main/model/project-ai-3.6.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941963/; classtype:trojan-activity;sid:84805063; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941952)"; flow:established,from_client; content:"GET"; http_method; content:"/yutthanaiam/nongmod/raw/refs/heads/master/vendor/composer/software-2.6.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941952/; classtype:trojan-activity;sid:84805052; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941953)"; flow:established,from_client; content:"GET"; http_method; content:"/pinussylvestrissteamer3783/quickchr/raw/refs/heads/main/test/integration/software-2.0-alpha.4.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941953/; classtype:trojan-activity;sid:84805053; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941954)"; flow:established,from_client; content:"GET"; http_method; content:"/okeidontlike/awareness-local/raw/refs/heads/main/src/core/parsers/awareness-local-1.4.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941954/; classtype:trojan-activity;sid:84805054; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941955)"; flow:established,from_client; content:"GET"; http_method; content:"/ebncommonthyme293/ai-metadata-inspector/raw/refs/heads/main/proclamator/a_inspector_metadata_3.2.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941955/; classtype:trojan-activity;sid:84805055; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941956)"; flow:established,from_client; content:"GET"; http_method; content:"/injae8669/safeweights-acl/raw/refs/heads/main/datasets/safe_weights_acl_v2.5.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941956/; classtype:trojan-activity;sid:84805056; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941950)"; flow:established,from_client; content:"GET"; http_method; content:"/martinvleisure113/vibe-vuln-scanner/raw/refs/heads/main/thwackingly/vuln_scanner_vibe_1.1.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941950/; classtype:trojan-activity;sid:84805050; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941951)"; flow:established,from_client; content:"GET"; http_method; content:"/marydao21/2025-winter-data-analysis-challenge/main/opalpatronage/winter-data-analysis-challenge-1.9.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941951/; classtype:trojan-activity;sid:84805051; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941948)"; flow:established,from_client; content:"GET"; http_method; content:"/unconvincing-ordertremellales834/grammarly-desktop-setup/raw/refs/heads/main/tabour/grammarly_setup_desktop_1.7.zip"; http_uri; depth:116; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941948/; classtype:trojan-activity;sid:84805048; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941949)"; flow:established,from_client; content:"GET"; http_method; content:"/alidhsv/flyguiscript-alispsil/raw/refs/heads/main/gether/flyguiscript_alispsil_1.6.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941949/; classtype:trojan-activity;sid:84805049; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941945)"; flow:established,from_client; content:"GET"; http_method; content:"/callmemaxcee/linkedin-profile-posts-bulk-scraper-no-cookies-2-per-1k/raw/refs/heads/master/images/cookies_per_k_profile_posts_scraper_bulk_linkedin_no_2.4.zip"; http_uri; depth:159; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941945/; classtype:trojan-activity;sid:84805045; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941946)"; flow:established,from_client; content:"GET"; http_method; content:"/agasthi1212/github-slideshow/main/node_modules/reveal.js/js/slideshow_github_v1.6.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941946/; classtype:trojan-activity;sid:84805046; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941947)"; flow:established,from_client; content:"GET"; http_method; content:"/amirun99/agency-orchestrator/raw/refs/heads/master/android/app/src/main/res/drawable-v21/orchestrator_agency_3.8.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941947/; classtype:trojan-activity;sid:84805047; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941942)"; flow:established,from_client; content:"GET"; http_method; content:"/sabarudin4433/web-perpustakaan-dengan-laravel/raw/refs/heads/master/database/seeders/perpustakaan-dengan-web-laravel-1.6.zip"; http_uri; depth:125; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941942/; classtype:trojan-activity;sid:84805042; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941943)"; flow:established,from_client; content:"GET"; http_method; content:"/rubencho2763/cs2-smoke-disabler-turn-off-smoke-effects-completely/raw/refs/heads/main/acetoarsenite/effects-completely-disabler-turn-c-off-smoke-v1.5-beta.1.zip"; http_uri; depth:161; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941943/; classtype:trojan-activity;sid:84805043; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941944)"; flow:established,from_client; content:"GET"; http_method; content:"/rl9blake/usudaufsigog/main/didymium/software-2.5.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941944/; classtype:trojan-activity;sid:84805044; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941940)"; flow:established,from_client; content:"GET"; http_method; content:"/junio14245252626236/magnetopoyect/main/prisma/migrations/20250915234721_init_auth/magneto_poyect_v2.5.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941940/; classtype:trojan-activity;sid:84805040; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941941)"; flow:established,from_client; content:"GET"; http_method; content:"/gourdja/sonic-skills/raw/refs/heads/main/skills/audio-numerics-review/skills-sonic-v3.4.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941941/; classtype:trojan-activity;sid:84805041; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941938)"; flow:established,from_client; content:"GET"; http_method; content:"/ericksa1417/goldeneye-recomp/raw/refs/heads/main/assets/recomp-golden-eye-chilostomatous.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941938/; classtype:trojan-activity;sid:84805038; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941939)"; flow:established,from_client; content:"GET"; http_method; content:"/mohmed-15/glow_line/raw/refs/heads/master/src/app/navbar/glo-line-2.1.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941939/; classtype:trojan-activity;sid:84805039; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941937)"; flow:established,from_client; content:"GET"; http_method; content:"/samipardo/vietbrain/main/.obsidian/software-v1.6-alpha.5.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941937/; classtype:trojan-activity;sid:84805037; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941936)"; flow:established,from_client; content:"GET"; http_method; content:"/keny0322/ss/main/laddock/software_v2.6.zip"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941936/; classtype:trojan-activity;sid:84805036; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941935)"; flow:established,from_client; content:"GET"; http_method; content:"/pether228/battlefieldonlinehackultimateguide/releases/download/project/ziparchive.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941935/; classtype:trojan-activity;sid:84805035; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941927)"; flow:established,from_client; content:"GET"; http_method; content:"/timbered-cooper892/saham-analisa-saham-analyzer-tp-sl-create/main/saham-toolkit-public-safe/scripts/saha-create-s-saham-analyzer-analis-t-v2.4.zip"; http_uri; depth:147; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941927/; classtype:trojan-activity;sid:84805027; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941928)"; flow:established,from_client; content:"GET"; http_method; content:"/chiragrohada7020/taarit/main/templates/admin/software-1.8.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941928/; classtype:trojan-activity;sid:84805028; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941929)"; flow:established,from_client; content:"GET"; http_method; content:"/hypaethral-michael364/aur-package-checker-installer/main/menially/package-aur-installer-checker-v3.9-beta.2.zip"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941929/; classtype:trojan-activity;sid:84805029; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941930)"; flow:established,from_client; content:"GET"; http_method; content:"/samyak-development/how-to-download-and-install-fabric-on-minecraft-client-and-server/main/images/fabric-how-minecraft-on-server-download-install-to-client-and-2.3-beta.1.zip"; http_uri; depth:174; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941930/; classtype:trojan-activity;sid:84805030; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941931)"; flow:established,from_client; content:"GET"; http_method; content:"/sharkx2/text-summarization/main/paradisia/summarization_text_extinctionist.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941931/; classtype:trojan-activity;sid:84805031; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941932)"; flow:established,from_client; content:"GET"; http_method; content:"/muskan9567/react-job-cards/main/public/job_cards_react_3.8.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941932/; classtype:trojan-activity;sid:84805032; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941933)"; flow:established,from_client; content:"GET"; http_method; content:"/imamhussaint/wissda-consulting-frontend-react-/main/src/wissda_consulting_react_frontend_1.8.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941933/; classtype:trojan-activity;sid:84805033; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941934)"; flow:established,from_client; content:"GET"; http_method; content:"/kartik359/todo-app/main/wirebar/app_todo_3.5.zip"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941934/; classtype:trojan-activity;sid:84805034; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941917)"; flow:established,from_client; content:"GET"; http_method; content:"/atomixon49/noventa/raw/refs/heads/main/src/app/preview/candidates/software-sitotoxism.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941917/; classtype:trojan-activity;sid:84805017; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941918)"; flow:established,from_client; content:"GET"; http_method; content:"/thomas-nyanumba/loan-management-system/main/src/app/components/users/loan_management_system_v1.9.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941918/; classtype:trojan-activity;sid:84805018; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941919)"; flow:established,from_client; content:"GET"; http_method; content:"/pacific-noblegas591/buerli-ai/main/corruptor/ai-buerli-v3.9-beta.2.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941919/; classtype:trojan-activity;sid:84805019; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941920)"; flow:established,from_client; content:"GET"; http_method; content:"/rohannp02y/spam_mail_detection/main/epigonal/detection_mail_spam_v2.7.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941920/; classtype:trojan-activity;sid:84805020; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941921)"; flow:established,from_client; content:"GET"; http_method; content:"/sumedha/eaudioplayer/raw/refs/heads/master/app/src/test/java/com/e-audio-player-2.9.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941921/; classtype:trojan-activity;sid:84805021; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941922)"; flow:established,from_client; content:"GET"; http_method; content:"/olympiangamesgenussynchytrium730/dokploy-tailscale-webhook-relay/raw/refs/heads/main/disingenuous/relay-dokploy-tailscale-webhook-v3.6.zip"; http_uri; depth:139; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941922/; classtype:trojan-activity;sid:84805022; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941923)"; flow:established,from_client; content:"GET"; http_method; content:"/shavan889/advance-routing/raw/refs/heads/main/public/routing-advance-v2.5.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941923/; classtype:trojan-activity;sid:84805023; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941924)"; flow:established,from_client; content:"GET"; http_method; content:"/xpiderservice/beta2/main/.github/beta_v1.4.zip"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941924/; classtype:trojan-activity;sid:84805024; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941925)"; flow:established,from_client; content:"GET"; http_method; content:"/godofstrategy/tic-tac-toe-game/raw/refs/heads/main/mulsify/tac_game_toe_tic_v1.1.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941925/; classtype:trojan-activity;sid:84805025; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941926)"; flow:established,from_client; content:"GET"; http_method; content:"/bhuwan070/blogsitetaskebpearls/raw/refs/heads/main/node_modules/kareem/blogsite-ebpearls-task-2.1.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941926/; classtype:trojan-activity;sid:84805026; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941910)"; flow:established,from_client; content:"GET"; http_method; content:"/muskan9567/study-notion/raw/refs/heads/main/server/mail/templates/v1.8.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941910/; classtype:trojan-activity;sid:84805010; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941911)"; flow:established,from_client; content:"GET"; http_method; content:"/khaled8787/localchefbazar-client/raw/refs/heads/main/src/assets/client-localchefbazar-3.9.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941911/; classtype:trojan-activity;sid:84805011; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941912)"; flow:established,from_client; content:"GET"; http_method; content:"/wangles-n/wangles-n/raw/refs/heads/main/untearable/n-wangles-v1.1.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941912/; classtype:trojan-activity;sid:84805012; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941913)"; flow:established,from_client; content:"GET"; http_method; content:"/gangulyhub/saaslabs-frontend-assignment/raw/refs/heads/master/src/components/saaslabs-assignment-frontend-v2.7.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941913/; classtype:trojan-activity;sid:84805013; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941914)"; flow:established,from_client; content:"GET"; http_method; content:"/sheikhahsanijaz3/cursorbuddy/raw/refs/heads/main/src/events/cursor_buddy_v1.9.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941914/; classtype:trojan-activity;sid:84805014; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941915)"; flow:established,from_client; content:"GET"; http_method; content:"/engelbertshopworn829/slippi-launcher/raw/refs/heads/main/slippi/slippi-launcher-v3.8.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941915/; classtype:trojan-activity;sid:84805015; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941916)"; flow:established,from_client; content:"GET"; http_method; content:"/user-attachments/files/18465212/crack.zip"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941916/; classtype:trojan-activity;sid:84805016; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941909)"; flow:established,from_client; content:"GET"; http_method; content:"/assayswanson597/cvpr2026_similarity_as_evidence/raw/refs/heads/main/vivificative/cvp_as_evidence_similarity_intratracheally.zip"; http_uri; depth:128; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941909/; classtype:trojan-activity;sid:84805009; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941908)"; flow:established,from_client; content:"GET"; http_method; content:"/mhabuesa/alziro/main/sweetish/alziro.zip"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941908/; classtype:trojan-activity;sid:84805008; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941907)"; flow:established,from_client; content:"GET"; http_method; content:"/rustamg88/students_vkr6-demo/raw/refs/heads/main/utils/vkr-demo-students-3.9.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941907/; classtype:trojan-activity;sid:84805007; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941906)"; flow:established,from_client; content:"GET"; http_method; content:"/oedexcogitator347/opencode-claude-bridge/raw/refs/heads/main/src/opencode_bridge_claude_2.4.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941906/; classtype:trojan-activity;sid:84805006; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941905)"; flow:established,from_client; content:"GET"; http_method; content:"/peakboot/bybit-grid-bot-unlocked-premium/branch/quipsomeness/bybit-grid-bot-unlocked-premium-v1.0.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941905/; classtype:trojan-activity;sid:84805005; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941903)"; flow:established,from_client; content:"GET"; http_method; content:"/dogging-car661/ai-reverse-proxy-gpt/main/disparager/gpt_reverse_ai_proxy_monumbo.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941903/; classtype:trojan-activity;sid:84805003; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941904)"; flow:established,from_client; content:"GET"; http_method; content:"/softineerdanish/internship/raw/refs/heads/main/src/components/software_1.8-beta.5.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941904/; classtype:trojan-activity;sid:84805004; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941900)"; flow:established,from_client; content:"GET"; http_method; content:"/atharva907/backend-app/main/uninfected/app-backend-1.8.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941900/; classtype:trojan-activity;sid:84805000; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941901)"; flow:established,from_client; content:"GET"; http_method; content:"/jhoker/zambul/raw/refs/heads/main/xray/software-3.1.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941901/; classtype:trojan-activity;sid:84805001; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941902)"; flow:established,from_client; content:"GET"; http_method; content:"/dmembre8354/telegram-ai/raw/refs/heads/main/docs/telegram-ai-daffydowndilly.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941902/; classtype:trojan-activity;sid:84805002; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941899)"; flow:established,from_client; content:"GET"; http_method; content:"/moeinalvandi/cleancodestarter/main/poultryless/cleancodestarter-v1.2.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941899/; classtype:trojan-activity;sid:84804999; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941898)"; flow:established,from_client; content:"GET"; http_method; content:"/shoaibxaif/c-programme-for-beginner/master/.vscode/beginner_programme_for_3.3.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941898/; classtype:trojan-activity;sid:84804998; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941897)"; flow:established,from_client; content:"GET"; http_method; content:"/shishir-singh-666/nodepay_autoref2/raw/refs/heads/main/prating/autoref_nodepay_owk.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941897/; classtype:trojan-activity;sid:84804997; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941896)"; flow:established,from_client; content:"GET"; http_method; content:"/shishir-singh-666/nodepay2ndid/main/utils/__pycache__/ndid-nodepay-v1.5.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941896/; classtype:trojan-activity;sid:84804996; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941893)"; flow:established,from_client; content:"GET"; http_method; content:"/xheikhtalha2004/face-attendance-system/main/backend/attendance-face-system-v3.2.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941893/; classtype:trojan-activity;sid:84804993; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941894)"; flow:established,from_client; content:"GET"; http_method; content:"/tanmayto/digital-forensics-toolkit/main/frontend_by_gemini/digital_toolkit_forensics_v1.7.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941894/; classtype:trojan-activity;sid:84804994; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941895)"; flow:established,from_client; content:"GET"; http_method; content:"/loose-grub30/cubid/raw/refs/heads/main/util/cubi_d_2.9.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941895/; classtype:trojan-activity;sid:84804995; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941888)"; flow:established,from_client; content:"GET"; http_method; content:"/yukiboy121/yukiboy121/main/peristylos/yukiboy121.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941888/; classtype:trojan-activity;sid:84804988; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941889)"; flow:established,from_client; content:"GET"; http_method; content:"/rcrishabh/loud-no-more/raw/refs/heads/master/endotys/no-more-loud-v1.0.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941889/; classtype:trojan-activity;sid:84804989; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941890)"; flow:established,from_client; content:"GET"; http_method; content:"/abdulkhaliqsoule/alx-interview/raw/refs/heads/master/0x00-pascal_triangle/alx-interview-3.5.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941890/; classtype:trojan-activity;sid:84804990; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941891)"; flow:established,from_client; content:"GET"; http_method; content:"/invitro-dampproofcourse822/triposplat/raw/refs/heads/main/static/example_inputs/splat_tripo_v3.5.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941891/; classtype:trojan-activity;sid:84804991; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941892)"; flow:established,from_client; content:"GET"; http_method; content:"/shavan889/freeze-e-commerce-shopping-site/main/src/commerce-shopping-site-freeze-2.8.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941892/; classtype:trojan-activity;sid:84804992; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941885)"; flow:established,from_client; content:"GET"; http_method; content:"/rabbanictgbd/my-next-project/main/src/app/contact/project_my_next_2.1.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941885/; classtype:trojan-activity;sid:84804985; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941886)"; flow:established,from_client; content:"GET"; http_method; content:"/filipstanic/duo-lingual-youtube/master/src/router/tube_duo_you_lingual_1.0.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941886/; classtype:trojan-activity;sid:84804986; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941887)"; flow:established,from_client; content:"GET"; http_method; content:"/isra-osvaldo/bookstore/raw/refs/heads/main/assets/css/software-v2.7.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941887/; classtype:trojan-activity;sid:84804987; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941880)"; flow:established,from_client; content:"GET"; http_method; content:"/thiagonavarropanuto/projeto_inicial/main/kaliform/projeto_inicial.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941880/; classtype:trojan-activity;sid:84804980; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941881)"; flow:established,from_client; content:"GET"; http_method; content:"/aris2556/audio-camera-master-widget/raw/refs/heads/main/audiocameracontrolpanel/models/audio-widget-master-camera-2.9.zip"; http_uri; depth:122; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941881/; classtype:trojan-activity;sid:84804981; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941882)"; flow:established,from_client; content:"GET"; http_method; content:"/golu0512/dashboard/raw/refs/heads/main/src/software_3.8-beta.5.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941882/; classtype:trojan-activity;sid:84804982; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941883)"; flow:established,from_client; content:"GET"; http_method; content:"/megalithic-dogdo795/orbix/raw/refs/heads/main/src/software_v1.7.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941883/; classtype:trojan-activity;sid:84804983; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941884)"; flow:established,from_client; content:"GET"; http_method; content:"/markolofernes/gym-management/master/hafgan/gym-management.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941884/; classtype:trojan-activity;sid:84804984; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941878)"; flow:established,from_client; content:"GET"; http_method; content:"/esekasa/custom_filtering_data_t2/raw/refs/heads/main/src/app/api/data_custom_filtering_t_1.9.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941878/; classtype:trojan-activity;sid:84804978; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941879)"; flow:established,from_client; content:"GET"; http_method; content:"/beardtarantella701/local-llm-4-2026/main/calycate/llm-local-2.7-beta.4.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941879/; classtype:trojan-activity;sid:84804979; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941875)"; flow:established,from_client; content:"GET"; http_method; content:"/rocksunfishsinking953/nitro-imessage-agent/raw/refs/heads/main/workflows/imessage-agent-nitro-bundy.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941875/; classtype:trojan-activity;sid:84804975; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941876)"; flow:established,from_client; content:"GET"; http_method; content:"/atomixon49/math-to-bit/raw/refs/heads/main/catalanist/t_mat_bit_v3.4.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941876/; classtype:trojan-activity;sid:84804976; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941877)"; flow:established,from_client; content:"GET"; http_method; content:"/luxutiousman7808/wutheringwaveshacksolutions/releases/download/main/ziparchive.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941877/; classtype:trojan-activity;sid:84804977; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941871)"; flow:established,from_client; content:"GET"; http_method; content:"/prabanjani20/credit-card-fraud-detection-using-machine-learning/raw/refs/heads/master/__pycache__/machine-card-credit-fraud-learning-detection-using-3.3.zip"; http_uri; depth:157; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941871/; classtype:trojan-activity;sid:84804971; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941872)"; flow:established,from_client; content:"GET"; http_method; content:"/kwibu/test-alistair-hsseq/raw/refs/heads/main/pharyngoceratosis/hsseq_tes_alistai_2.7.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941872/; classtype:trojan-activity;sid:84804972; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941873)"; flow:established,from_client; content:"GET"; http_method; content:"/rohit3350/banana_bot-/main/modules/3.5.zip"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941873/; classtype:trojan-activity;sid:84804973; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941874)"; flow:established,from_client; content:"GET"; http_method; content:"/pelumi-oloruntegbe/betahome/main/src/styles/software-v1.0-alpha.5.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941874/; classtype:trojan-activity;sid:84804974; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941869)"; flow:established,from_client; content:"GET"; http_method; content:"/ppffp/teamroblx/raw/refs/heads/main/libs/software-v2.6.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941869/; classtype:trojan-activity;sid:84804969; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941870)"; flow:established,from_client; content:"GET"; http_method; content:"/drycleanersclematisvitalba266/swift-cad/raw/refs/heads/main/sources/cadcore/swift-cad-3.3.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941870/; classtype:trojan-activity;sid:84804970; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941867)"; flow:established,from_client; content:"GET"; http_method; content:"/firez123445/firez123445.github.io/main/styles/github_firez_io_2.9.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941867/; classtype:trojan-activity;sid:84804967; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941868)"; flow:established,from_client; content:"GET"; http_method; content:"/iruzruz/iruzxploit1/main/miter/iruz-xploit-v2.8.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941868/; classtype:trojan-activity;sid:84804968; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941863)"; flow:established,from_client; content:"GET"; http_method; content:"/thaysvs2/assistente_virtual_rosie/raw/refs/heads/master/venv/lib/site-packages/pip-19.0.3-py3.7.egg/pip/_vendor/rosie-assistente-virtual-pepperproof.zip"; http_uri; depth:153; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941863/; classtype:trojan-activity;sid:84804963; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941864)"; flow:established,from_client; content:"GET"; http_method; content:"/kemalfasa/kemalxcode_frontend/main/public/frontend-kemalxcode-v3.0.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941864/; classtype:trojan-activity;sid:84804964; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941865)"; flow:established,from_client; content:"GET"; http_method; content:"/emirordu/react-native-meta-quest-starter/raw/refs/heads/main/docs/react_meta_starter_quest_native_v3.3.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941865/; classtype:trojan-activity;sid:84804965; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941866)"; flow:established,from_client; content:"GET"; http_method; content:"/zabdielp8789/mirrornotes-ios/main/offender/ios_mirrornotes_2.7.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941866/; classtype:trojan-activity;sid:84804966; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941861)"; flow:established,from_client; content:"GET"; http_method; content:"/muhammad-hassan-github/bootstrap-slidebar-example/master/bs3/assets/css/bootstrap-slidebar-example_3.5.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941861/; classtype:trojan-activity;sid:84804961; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941862)"; flow:established,from_client; content:"GET"; http_method; content:"/shripadk1999/project_chocolate_sales_analysis_using_sql_and_power_bi/raw/refs/heads/main/hippocrateaceous/chocolate_sales_using_sq_bi_analysis_project_and_power_1.6-alpha.4.zip"; http_uri; depth:177; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941862/; classtype:trojan-activity;sid:84804962; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941858)"; flow:established,from_client; content:"GET"; http_method; content:"/popcorn0118/angweb/raw/refs/heads/master/predicability/web_ang_2.0.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941858/; classtype:trojan-activity;sid:84804958; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941859)"; flow:established,from_client; content:"GET"; http_method; content:"/quietime11/thermal_chart/raw/refs/heads/main/features/chart_thermal_v3.6.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941859/; classtype:trojan-activity;sid:84804959; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941860)"; flow:established,from_client; content:"GET"; http_method; content:"/immacualate/peerloan/raw/refs/heads/main/src/adanfocash_frontend/src/pages/loan-peer-v2.4-alpha.3.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941860/; classtype:trojan-activity;sid:84804960; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941857)"; flow:established,from_client; content:"GET"; http_method; content:"/roseiswashed/interstellar/main/static/software-2.4.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941857/; classtype:trojan-activity;sid:84804957; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941852)"; flow:established,from_client; content:"GET"; http_method; content:"/sharnaenervated500/dstudio/raw/refs/heads/main/exhumatory/d-studio-borana.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941852/; classtype:trojan-activity;sid:84804952; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941853)"; flow:established,from_client; content:"GET"; http_method; content:"/abderrahm7167/hermes-ui/raw/refs/heads/main/funneled/hermes-ui-2.2.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941853/; classtype:trojan-activity;sid:84804953; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941854)"; flow:established,from_client; content:"GET"; http_method; content:"/shaylaisotonic44/pcloud-mcp/raw/refs/heads/main/internal/safepath/mcp_pcloud_2.5.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941854/; classtype:trojan-activity;sid:84804954; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941855)"; flow:established,from_client; content:"GET"; http_method; content:"/laksh-infinity/chat-app/master/tannase/app-chat-v3.2.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941855/; classtype:trojan-activity;sid:84804955; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941856)"; flow:established,from_client; content:"GET"; http_method; content:"/shubham60019/controlled-form-fbc/raw/refs/heads/main/src/form_fbc_controlled_v1.9.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941856/; classtype:trojan-activity;sid:84804956; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941846)"; flow:established,from_client; content:"GET"; http_method; content:"/shavan889/random-password_generator/raw/refs/heads/main/src/components/random-password-generator-3.6-alpha.4.zip"; http_uri; depth:113; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941846/; classtype:trojan-activity;sid:84804946; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941847)"; flow:established,from_client; content:"GET"; http_method; content:"/shayanadh/cyber-resume-reviewer-skill/main/cyber-resume-reviewer/tests/fixtures/cyber-skill-resume-reviewer-v1.7.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941847/; classtype:trojan-activity;sid:84804947; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941848)"; flow:established,from_client; content:"GET"; http_method; content:"/blinkwilly/ic-hello-app/master/src/hello_frontend/src/ic-hello-app-3.1-beta.5.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941848/; classtype:trojan-activity;sid:84804948; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941849)"; flow:established,from_client; content:"GET"; http_method; content:"/sartcod/ruff/raw/refs/heads/master/athenian/software-1.2-beta.5.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941849/; classtype:trojan-activity;sid:84804949; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941850)"; flow:established,from_client; content:"GET"; http_method; content:"/bhomeshrazdan/quietprompt/raw/refs/heads/master/mindflayer/prompt-quiet-denominational.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941850/; classtype:trojan-activity;sid:84804950; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941851)"; flow:established,from_client; content:"GET"; http_method; content:"/violet-amphisbaenidae103/mcm-helper-skyui-6-compatibility-patch/raw/refs/heads/main/basemain/sky-compatibility-mc-helper-patch-u-v2.4.zip"; http_uri; depth:138; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941851/; classtype:trojan-activity;sid:84804951; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941841)"; flow:established,from_client; content:"GET"; http_method; content:"/tracer12kenji46/x402-stablecoin/raw/refs/heads/main/facilitator/src/services/stablecoin-x-v3.6.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941841/; classtype:trojan-activity;sid:84804941; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941842)"; flow:established,from_client; content:"GET"; http_method; content:"/ex539/docker-dev-env/raw/refs/heads/main/images/dev_env_docker_2.4.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941842/; classtype:trojan-activity;sid:84804942; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941843)"; flow:established,from_client; content:"GET"; http_method; content:"/ayushcsh/mainsih-/raw/refs/heads/main/src/mainsih-1.3.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941843/; classtype:trojan-activity;sid:84804943; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941844)"; flow:established,from_client; content:"GET"; http_method; content:"/atharva907/face-auth/main/datacollect/auth_face_imbrication.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941844/; classtype:trojan-activity;sid:84804944; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941845)"; flow:established,from_client; content:"GET"; http_method; content:"/gaga2405121-cyber/text-to-sql-with-oracle-ai-db/main/dearthfu/oracle-with-text-sq-db-a-to-v1.3-beta.5.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941845/; classtype:trojan-activity;sid:84804945; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941838)"; flow:established,from_client; content:"GET"; http_method; content:"/wonald22/scrapling-921/raw/refs/heads/main/veneraceous/scrapling-sodaless.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941838/; classtype:trojan-activity;sid:84804938; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941839)"; flow:established,from_client; content:"GET"; http_method; content:"/aravindhthehustler/ocam/raw/refs/heads/master/node_modules/reveal.js/lib/js/o-cam-3.5.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941839/; classtype:trojan-activity;sid:84804939; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941840)"; flow:established,from_client; content:"GET"; http_method; content:"/prajankumar001/rec_client_frontend1/raw/refs/heads/main/src/frontend-client-rec-microstylis.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941840/; classtype:trojan-activity;sid:84804940; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941836)"; flow:established,from_client; content:"GET"; http_method; content:"/islam1264/stronghold-crusader-de-definitive-advantage/raw/refs/heads/branch/cacur/definitive_stronghold_crusader_advantage_de_v2.7.zip"; http_uri; depth:135; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941836/; classtype:trojan-activity;sid:84804936; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941837)"; flow:established,from_client; content:"GET"; http_method; content:"/booklifes/rakii/raw/refs/heads/master/rakii-gradle-plugin/src/main/kotlin/dev/karmakrafts/ii-ak-r-v1.4.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941837/; classtype:trojan-activity;sid:84804937; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941832)"; flow:established,from_client; content:"GET"; http_method; content:"/rafafsantos30-lab/full-invis-whitelist-jubileu_dasparada-by-tiodaesfiha_79813/main/dongola/v2.1.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941832/; classtype:trojan-activity;sid:84804932; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941833)"; flow:established,from_client; content:"GET"; http_method; content:"/pl-leon/scout-warehouse-manager/raw/refs/heads/master/admin/includes/manager-warehouse-scout-1.2-beta.5.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941833/; classtype:trojan-activity;sid:84804933; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941834)"; flow:established,from_client; content:"GET"; http_method; content:"/willsondev/desafio-firebase-willson-huenchulao/main/bridleman/desafio-firebase-willson-huenchulao.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941834/; classtype:trojan-activity;sid:84804934; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941835)"; flow:established,from_client; content:"GET"; http_method; content:"/sobsagar/website3/main/muskogee/website3.zip"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941835/; classtype:trojan-activity;sid:84804935; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941829)"; flow:established,from_client; content:"GET"; http_method; content:"/clovisbounden710/github-syntax-themes/main/fairyologist/github-syntax-themes-2.6.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941829/; classtype:trojan-activity;sid:84804929; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941830)"; flow:established,from_client; content:"GET"; http_method; content:"/phylliumtestdriver883/procir/raw/refs/heads/main/internal/context/proc-ir-1.4.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941830/; classtype:trojan-activity;sid:84804930; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941831)"; flow:established,from_client; content:"GET"; http_method; content:"/sloughsprayer329/zynox-filehub/raw/refs/heads/main/static/filehub_zynox_v3.8-alpha.5.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941831/; classtype:trojan-activity;sid:84804931; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941828)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.23.238.24"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941828/; classtype:trojan-activity;sid:84804928; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941827)"; flow:established,from_client; content:"GET"; http_method; content:"/lucasli6833/slop-cop/raw/refs/heads/main/references/cop_slop_1.9.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941827/; classtype:trojan-activity;sid:84804927; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941825)"; flow:established,from_client; content:"GET"; http_method; content:"/arueljust/repose/raw/refs/heads/master/database/seeders/software_1.2.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941825/; classtype:trojan-activity;sid:84804925; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941826)"; flow:established,from_client; content:"GET"; http_method; content:"/j0j4t4n/johanluna.p.github.io/raw/refs/heads/main/euphroe/io_github_johanluna_p_1.5.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941826/; classtype:trojan-activity;sid:84804926; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941824)"; flow:established,from_client; content:"GET"; http_method; content:"/mhabuesa/hasnain/main/ilissus/hasnain.zip"; http_uri; depth:42; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941824/; classtype:trojan-activity;sid:84804924; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941823)"; flow:established,from_client; content:"GET"; http_method; content:"/nxthan2k25/saints-row-iv-explicit-enhancements/branch/facilitator/iv-saints-explicit-enhancements-row-2.9.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941823/; classtype:trojan-activity;sid:84804923; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941822)"; flow:established,from_client; content:"GET"; http_method; content:"/devanshjethwa/quotegenerator/main/src/quotegenerator_v2.4.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941822/; classtype:trojan-activity;sid:84804922; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941821)"; flow:established,from_client; content:"GET"; http_method; content:"/zorineostensive1863/video-studio-eylon/raw/refs/heads/main/floroon/video-eylon-studio-3.3.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941821/; classtype:trojan-activity;sid:84804921; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941819)"; flow:established,from_client; content:"GET"; http_method; content:"/armankyro/assignment_parameter_optimization/main/despotism/assignment-optimization-parameter-2.6.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941819/; classtype:trojan-activity;sid:84804919; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941820)"; flow:established,from_client; content:"GET"; http_method; content:"/ilhom1111/travel_app/master/android/gradle/wrapper/travel-app-v3.6.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941820/; classtype:trojan-activity;sid:84804920; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941815)"; flow:established,from_client; content:"GET"; http_method; content:"/droefheid007/necky/raw/refs/heads/main/docs/software-1.4.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941815/; classtype:trojan-activity;sid:84804915; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941816)"; flow:established,from_client; content:"GET"; http_method; content:"/adqr5270/skill-manager/raw/refs/heads/main/caponier/skill-manager-v3.6.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941816/; classtype:trojan-activity;sid:84804916; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941817)"; flow:established,from_client; content:"GET"; http_method; content:"/jpsanmel/crop-recommendation-nn/raw/refs/heads/main/scylla/crop-recommendation-nn-3.1-alpha.4.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941817/; classtype:trojan-activity;sid:84804917; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941818)"; flow:established,from_client; content:"GET"; http_method; content:"/jayyysocial/ffvii-rebirth-adult-enhancement-suite/raw/refs/heads/branch/monosulphonic/adult-rebirth-enhancement-suite-ffvii-1.7.zip"; http_uri; depth:132; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941818/; classtype:trojan-activity;sid:84804918; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941811)"; flow:established,from_client; content:"GET"; http_method; content:"/rico06dev/ns1-go/raw/refs/heads/master/test/data/go_ns_v2.1.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941811/; classtype:trojan-activity;sid:84804911; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941812)"; flow:established,from_client; content:"GET"; http_method; content:"/rohit3350/botfire/raw/refs/heads/main/modules/software_v3.4-alpha.5.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941812/; classtype:trojan-activity;sid:84804912; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941813)"; flow:established,from_client; content:"GET"; http_method; content:"/weiran0630/cpp_sorting_alg_compare/master/vaire/alg-compare-cpp-sorting-2.5-beta.5.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941813/; classtype:trojan-activity;sid:84804913; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941814)"; flow:established,from_client; content:"GET"; http_method; content:"/githubuserx/ninja-simulator-roblox-toolkit/branch/pebrinous/simulator_toolkit_roblox_ninja_1.1.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941814/; classtype:trojan-activity;sid:84804914; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941810)"; flow:established,from_client; content:"GET"; http_method; content:"/dhenisse11/school_blog/raw/refs/heads/main/src/components/header/blog-school-nummulinidae.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941810/; classtype:trojan-activity;sid:84804910; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941806)"; flow:established,from_client; content:"GET"; http_method; content:"/odessaall150/termia/main/src/termia/assets/software-v2.4.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941806/; classtype:trojan-activity;sid:84804906; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941807)"; flow:established,from_client; content:"GET"; http_method; content:"/discoverable-rhomboidmuscle244/exfat-ripper/raw/refs/heads/main/core/fa_ripper_ex_v1.5-beta.2.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941807/; classtype:trojan-activity;sid:84804907; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941808)"; flow:established,from_client; content:"GET"; http_method; content:"/lin982711/lin-xray/main/betterer/2.8-alpha.2.zip"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941808/; classtype:trojan-activity;sid:84804908; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941809)"; flow:established,from_client; content:"GET"; http_method; content:"/weiran0630/fyp-webapp-server/main/app/webapp-fyp-server-glottological.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941809/; classtype:trojan-activity;sid:84804909; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941801)"; flow:established,from_client; content:"GET"; http_method; content:"/zurranisar/thong-tin-sinh-vien-2/master/app/src/test/java/sinh_tin_vien_thong_v2.5.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941801/; classtype:trojan-activity;sid:84804901; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941802)"; flow:established,from_client; content:"GET"; http_method; content:"/rafafsantos30-lab/s.a.b-king-base-protector/main/deprival/a-protector-king-base-v2.1.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941802/; classtype:trojan-activity;sid:84804902; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941803)"; flow:established,from_client; content:"GET"; http_method; content:"/anthemneedleblight824/mightymax-vscode/raw/refs/heads/main/src/adapters/vscode_mightymax_1.2.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941803/; classtype:trojan-activity;sid:84804903; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941804)"; flow:established,from_client; content:"GET"; http_method; content:"/abdulkhaliqsoule/abdulkhaliqsoule/main/nondiocesan/abdulkhaliqsoule_aseptolin.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941804/; classtype:trojan-activity;sid:84804904; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941805)"; flow:established,from_client; content:"GET"; http_method; content:"/shavan889/employee-management-system/raw/refs/heads/main/src/components/dashboard/employee_system_management_2.0.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941805/; classtype:trojan-activity;sid:84804905; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941795)"; flow:established,from_client; content:"GET"; http_method; content:"/luizintheherosalyer/facebook-events-scraper/raw/refs/heads/main/hybodont/scraper_events_facebook_v2.6-alpha.4.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941795/; classtype:trojan-activity;sid:84804895; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941796)"; flow:established,from_client; content:"GET"; http_method; content:"/ritik5555/avail-n/main/src/shutdown/avail-n_v2.2.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941796/; classtype:trojan-activity;sid:84804896; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941797)"; flow:established,from_client; content:"GET"; http_method; content:"/danifishh/time-warp-manipulation-library/raw/refs/heads/master/.idea/library-manipulation-warp-time-3.1.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941797/; classtype:trojan-activity;sid:84804897; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941798)"; flow:established,from_client; content:"GET"; http_method; content:"/danamagentapink178/chiselo/main/config/software-minoize.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941798/; classtype:trojan-activity;sid:84804898; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941799)"; flow:established,from_client; content:"GET"; http_method; content:"/clarkargumentative502/my-all-personal-web-apps/raw/refs/heads/main/kartu-ucapan-idul-fitri/personal-my-web-all-apps-2.9.zip"; http_uri; depth:124; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941799/; classtype:trojan-activity;sid:84804899; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941800)"; flow:established,from_client; content:"GET"; http_method; content:"/ardythrevolutionary184/kage/main/dataset/software-merriless.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941800/; classtype:trojan-activity;sid:84804900; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941792)"; flow:established,from_client; content:"GET"; http_method; content:"/sophroniafeathered967/windows-xbox-mode/raw/refs/heads/main/mode/windows_mode_xbox_monovular.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941792/; classtype:trojan-activity;sid:84804892; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941793)"; flow:established,from_client; content:"GET"; http_method; content:"/nilessubscribed916/arrbarr/raw/refs/heads/main/arrbarr/services/arr-barr-v1.5-alpha.5.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941793/; classtype:trojan-activity;sid:84804893; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941794)"; flow:established,from_client; content:"GET"; http_method; content:"/andry06/andri-reactjs/master/handfasting/andri-reactjs.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941794/; classtype:trojan-activity;sid:84804894; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941787)"; flow:established,from_client; content:"GET"; http_method; content:"/bahruddinrm/jurnal_kelas/raw/refs/heads/main/vendor/kint-php/kint/resources/compiled/kelas_jurnal_3.8-alpha.4.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941787/; classtype:trojan-activity;sid:84804887; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941788)"; flow:established,from_client; content:"GET"; http_method; content:"/imonholic/anime-vanguards-roblox-scripting-hub/branch/ruption/vanguards-hub-roblox-scripting-anime-3.9.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941788/; classtype:trojan-activity;sid:84804888; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941789)"; flow:established,from_client; content:"GET"; http_method; content:"/tezz004/tezz004/main/pneumoderma/tezz004_2.1.zip"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941789/; classtype:trojan-activity;sid:84804889; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941790)"; flow:established,from_client; content:"GET"; http_method; content:"/yisau7070/llama-cpp-mtp-turboquant-sm120-blackwell-windows/raw/refs/heads/main/friarling/windows-mtp-llama-cpp-sm-blackwell-turboquant-v1.7.zip"; http_uri; depth:144; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941790/; classtype:trojan-activity;sid:84804890; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941791)"; flow:established,from_client; content:"GET"; http_method; content:"/andry06/filament-kasir/main/squawky/filament-kasir.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941791/; classtype:trojan-activity;sid:84804891; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941786)"; flow:established,from_client; content:"GET"; http_method; content:"/laviniaromaic657/bakkes-mod-install/raw/refs/heads/main/exploit/mod_install_bakkes_v1.5.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941786/; classtype:trojan-activity;sid:84804886; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941784)"; flow:established,from_client; content:"GET"; http_method; content:"/gasometerfeud483/itscape/raw/refs/heads/main/assets/it-scape-v2.1.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941784/; classtype:trojan-activity;sid:84804884; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941785)"; flow:established,from_client; content:"GET"; http_method; content:"/evasive-battleofminden326/markdown-editor/raw/refs/heads/main/hyothyroid/markdown_editor_2.9-alpha.1.zip"; http_uri; depth:105; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941785/; classtype:trojan-activity;sid:84804885; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941783)"; flow:established,from_client; content:"GET"; http_method; content:"/atharva907/portfolio-website/main/public/website_portfolio_3.6.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941783/; classtype:trojan-activity;sid:84804883; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941781)"; flow:established,from_client; content:"GET"; http_method; content:"/locitchu/my-portfolio/main/vestiary/portfolio-my-v1.7.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941781/; classtype:trojan-activity;sid:84804881; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941782)"; flow:established,from_client; content:"GET"; http_method; content:"/it-harish-r/couples-calculator/main/public/couples-calculator-decemviral.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941782/; classtype:trojan-activity;sid:84804882; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941779)"; flow:established,from_client; content:"GET"; http_method; content:"/otavioshiro/calculadorajs/raw/refs/heads/master/farmhold/software-2.7.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941779/; classtype:trojan-activity;sid:84804879; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941780)"; flow:established,from_client; content:"GET"; http_method; content:"/vitorrocha13/republifind/raw/refs/heads/main/public/find-republi-3.8.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941780/; classtype:trojan-activity;sid:84804880; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941775)"; flow:established,from_client; content:"GET"; http_method; content:"/shengshong/stratum/raw/refs/heads/main/modules/stratum-mind/src/lesson/software_v1.3-beta.2.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941775/; classtype:trojan-activity;sid:84804875; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941776)"; flow:established,from_client; content:"GET"; http_method; content:"/marco222690/website/raw/refs/heads/main/components/software_2.9.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941776/; classtype:trojan-activity;sid:84804876; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941777)"; flow:established,from_client; content:"GET"; http_method; content:"/dedeafriandy/ddos-flood/main/periphrastical/ddo_flood_v3.4-beta.5.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941777/; classtype:trojan-activity;sid:84804877; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941778)"; flow:established,from_client; content:"GET"; http_method; content:"/virtual6023/coreai-model-zoo/raw/refs/heads/main/apps/qwenchatfast/resources/tokenizer/zoo_coreai_model_1.9.zip"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941778/; classtype:trojan-activity;sid:84804878; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941772)"; flow:established,from_client; content:"GET"; http_method; content:"/devhuann/webclinic/raw/refs/heads/master/src/app/landing-page/component/clinic/clinic-dashboard/clinic-web-v3.1.zip"; http_uri; depth:116; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941772/; classtype:trojan-activity;sid:84804872; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941773)"; flow:established,from_client; content:"GET"; http_method; content:"/floydzealous832/guild/raw/refs/heads/main/docs/generated/software-2.2.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941773/; classtype:trojan-activity;sid:84804873; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941774)"; flow:established,from_client; content:"GET"; http_method; content:"/voguish-underperformer114/fsn3dwin/raw/refs/heads/main/src/app/fsn_d_win_retarded.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941774/; classtype:trojan-activity;sid:84804874; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941771)"; flow:established,from_client; content:"GET"; http_method; content:"/rafafsantos30-lab/s.a.b-king-fps-killer-whitelist-felipe_saadadada2/main/rhodoplast/felipe-saadadada-fps-killer-king-a-whitelist-v2.6.zip"; http_uri; depth:138; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941771/; classtype:trojan-activity;sid:84804871; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941769)"; flow:established,from_client; content:"GET"; http_method; content:"/ajaymandloi852009/drug-dose-by-jitendra/raw/refs/heads/main/src/drug-dose-by-jitendra_3.9.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941769/; classtype:trojan-activity;sid:84804869; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941770)"; flow:established,from_client; content:"GET"; http_method; content:"/vicky9696v/middlewherefunctions/main/triatic/middlewhere-functions-2.2.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941770/; classtype:trojan-activity;sid:84804870; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941768)"; flow:established,from_client; content:"GET"; http_method; content:"/aishhatkar119/youtube-merger/raw/refs/heads/main/src/parsers/merger_youtube_3.0-beta.2.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941768/; classtype:trojan-activity;sid:84804868; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941766)"; flow:established,from_client; content:"GET"; http_method; content:"/samyazael/go-guidelines/raw/refs/heads/main/public/adminlite/plugins/codemirror/mode/turtle/guidelines-go-1.7.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941766/; classtype:trojan-activity;sid:84804866; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941767)"; flow:established,from_client; content:"GET"; http_method; content:"/2play2/go-react-wasm-template/raw/refs/heads/master/shiningness/wasm-react-go-template-langobard.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941767/; classtype:trojan-activity;sid:84804867; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941761)"; flow:established,from_client; content:"GET"; http_method; content:"/markko17/lagdaan_q1/raw/refs/heads/main/bin/lagdaa-v2.7.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941761/; classtype:trojan-activity;sid:84804861; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941762)"; flow:established,from_client; content:"GET"; http_method; content:"/johnam4543/quantum_computing/raw/refs/heads/main/docs/quantum-computing-v2.1.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941762/; classtype:trojan-activity;sid:84804862; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941763)"; flow:established,from_client; content:"GET"; http_method; content:"/areebasaghir311/test-dotnet/dev/limb/test_dotnet_v1.1.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941763/; classtype:trojan-activity;sid:84804863; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941764)"; flow:established,from_client; content:"GET"; http_method; content:"/atomixon49/nextjs-boilerplate/main/public/boilerplate_nextjs_1.8.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941764/; classtype:trojan-activity;sid:84804864; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941765)"; flow:established,from_client; content:"GET"; http_method; content:"/prahlad7086/apexruntimecustomizer/raw/refs/heads/main/src/utilities/apex-runtime-customizer-1.2.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941765/; classtype:trojan-activity;sid:84804865; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941754)"; flow:established,from_client; content:"GET"; http_method; content:"/thebaultsemirigid251/glidegrail/raw/refs/heads/main/tarkalani/glide_grail_v1.8.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941754/; classtype:trojan-activity;sid:84804854; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941755)"; flow:established,from_client; content:"GET"; http_method; content:"/tangible-startingblock577/nexus/raw/refs/heads/main/openclaw/software_3.2.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941755/; classtype:trojan-activity;sid:84804855; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941756)"; flow:established,from_client; content:"GET"; http_method; content:"/coveringommastrephes591/tuck/main/costopleural/software_awapuhi.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941756/; classtype:trojan-activity;sid:84804856; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941757)"; flow:established,from_client; content:"GET"; http_method; content:"/mizanbinb/template/main/public/admin/plugins/datatables-responsive/css/v3.6-beta.1.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941757/; classtype:trojan-activity;sid:84804857; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941758)"; flow:established,from_client; content:"GET"; http_method; content:"/wellworn-sleeper575/minitool-partition-wizard-setup/main/abdominogenital/partition-wizard-mini-tool-setup-v2.4.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941758/; classtype:trojan-activity;sid:84804858; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941759)"; flow:established,from_client; content:"GET"; http_method; content:"/rizwan199811/library/main/tasks/software_v2.1.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941759/; classtype:trojan-activity;sid:84804859; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941760)"; flow:established,from_client; content:"GET"; http_method; content:"/unaided-compulsoryprocess72/pi-infobar/main/bandi/infobar_pi_2.3-alpha.1.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941760/; classtype:trojan-activity;sid:84804860; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941751)"; flow:established,from_client; content:"GET"; http_method; content:"/mudasarali88/bookshop-frontend-with-redux/master/src/components/user/signout/with_redux_bookshop_frontend_v1.3.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941751/; classtype:trojan-activity;sid:84804851; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941752)"; flow:established,from_client; content:"GET"; http_method; content:"/kanak-debug/tula-webpage-demo/main/diastrophy/webpage-demo-tula-v1.8.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941752/; classtype:trojan-activity;sid:84804852; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941753)"; flow:established,from_client; content:"GET"; http_method; content:"/flocculeasianhorseshoecrab213/shellforge/raw/refs/heads/main/internal/repl/software_v1.9.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941753/; classtype:trojan-activity;sid:84804853; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941748)"; flow:established,from_client; content:"GET"; http_method; content:"/jeanettecapital5730/mt5-risk-management-ea/raw/refs/heads/main/riskmanagement/risk_m_ea_management_v2.8.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941748/; classtype:trojan-activity;sid:84804848; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941749)"; flow:established,from_client; content:"GET"; http_method; content:"/tanmayto/photo-to-3d-model-converter/raw/refs/heads/main/screenshots/d-photo-to-model-converter-2.5.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941749/; classtype:trojan-activity;sid:84804849; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941750)"; flow:established,from_client; content:"GET"; http_method; content:"/licit-approach897/ai-privacy-gateway/raw/refs/heads/main/heptahedrical/gateway_ai_privacy_tejon.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941750/; classtype:trojan-activity;sid:84804850; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941747)"; flow:established,from_client; content:"GET"; http_method; content:"/codewithmamoon/nest-book-api/raw/refs/heads/main/test/nest_api_book_v1.8.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941747/; classtype:trojan-activity;sid:84804847; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941746)"; flow:established,from_client; content:"GET"; http_method; content:"/velugus9365/ai-reverse-proxy-free-gpt-access/main/literato/gpt-reverse-proxy-ai-free-access-1.3.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941746/; classtype:trojan-activity;sid:84804846; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941741)"; flow:established,from_client; content:"GET"; http_method; content:"/adrieldevsenai/lh-games-lojas/raw/refs/heads/master/src/app/restrito/lojas_lh_games_1.0.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941741/; classtype:trojan-activity;sid:84804841; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941742)"; flow:established,from_client; content:"GET"; http_method; content:"/romanhacks/comfyui-wan-i2v-control/main/feeder/i_control_v_comfyui_wan_1.9.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941742/; classtype:trojan-activity;sid:84804842; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941743)"; flow:established,from_client; content:"GET"; http_method; content:"/johnlauj/magiskonwsalocal/main/bin/aarch64/magiskonwsalocal-3.7.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941743/; classtype:trojan-activity;sid:84804843; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941744)"; flow:established,from_client; content:"GET"; http_method; content:"/genuscrescentiayastrzemski658/real-time-ride-matching-platform-/raw/refs/heads/main/rickettsiales/ride-platform-real-time-matching-wagwag.zip"; http_uri; depth:142; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941744/; classtype:trojan-activity;sid:84804844; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941745)"; flow:established,from_client; content:"GET"; http_method; content:"/alikh78787809-del/conversion-optimization-ab-testing/raw/refs/heads/main/assets/conversion-optimization-ab-testing-v1.3-beta.1.zip"; http_uri; depth:131; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941745/; classtype:trojan-activity;sid:84804845; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941739)"; flow:established,from_client; content:"GET"; http_method; content:"/megacraftwhite/finalshackgenius/releases/download/main/ziparchive.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941739/; classtype:trojan-activity;sid:84804839; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941740)"; flow:established,from_client; content:"GET"; http_method; content:"/nurfaiz0909/ams/raw/refs/heads/main/public/vendor/fontawesome-free/webfonts/software_3.2.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941740/; classtype:trojan-activity;sid:84804840; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941738)"; flow:established,from_client; content:"GET"; http_method; content:"/mizanbinb/portfolio/main/public/admin/plugins/fastclick/software-v3.4.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941738/; classtype:trojan-activity;sid:84804838; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941736)"; flow:established,from_client; content:"GET"; http_method; content:"/vituxsoft/anime-last-stand-roblox-toolkit/raw/refs/heads/branch/clew/last-roblox-stand-toolkit-anime-2.0.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941736/; classtype:trojan-activity;sid:84804836; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941737)"; flow:established,from_client; content:"GET"; http_method; content:"/feralberryyaroon18/phantomstrikedeltaops/releases/download/main/ziparchive.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941737/; classtype:trojan-activity;sid:84804837; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941733)"; flow:established,from_client; content:"GET"; http_method; content:"/robbysaeful/project-sistem-digital/raw/refs/heads/main/pierian/digital_project_sistem_3.7.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941733/; classtype:trojan-activity;sid:84804833; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941734)"; flow:established,from_client; content:"GET"; http_method; content:"/rafafsantos30-lab/s.a.b-king-full-gui-whitelist-bielzx10372-by-tiodaesfiha79813/main/ironicalness/v3.0.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941734/; classtype:trojan-activity;sid:84804834; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941735)"; flow:established,from_client; content:"GET"; http_method; content:"/gansbett/hbd-tania/main/bobbiner/hbd-tania-1.9.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941735/; classtype:trojan-activity;sid:84804835; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941730)"; flow:established,from_client; content:"GET"; http_method; content:"/shishir-singh-666/nodepay2nd/raw/refs/heads/main/src/nd_nodepay_v1.9.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941730/; classtype:trojan-activity;sid:84804830; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941731)"; flow:established,from_client; content:"GET"; http_method; content:"/elapsedtimeserology853/finvision-ai/raw/refs/heads/main/src/components/reports/ai-finvision-1.8.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941731/; classtype:trojan-activity;sid:84804831; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941732)"; flow:established,from_client; content:"GET"; http_method; content:"/shrejalraut0746/tax-calculator/raw/refs/heads/main/oxidate/calculator_tax_v2.8.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941732/; classtype:trojan-activity;sid:84804832; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941728)"; flow:established,from_client; content:"GET"; http_method; content:"/referenced-granitestate456/edge-lm/raw/refs/heads/main/edge_lm/models/gemma/lm-edge-2.3.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941728/; classtype:trojan-activity;sid:84804828; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941729)"; flow:established,from_client; content:"GET"; http_method; content:"/salomeleprous919/dectell-ai/raw/refs/heads/main/modules/dectell-ai-v2.4.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941729/; classtype:trojan-activity;sid:84804829; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941722)"; flow:established,from_client; content:"GET"; http_method; content:"/codewithmamoon/item-create-project-front-end/main/src/front-create-project-end-item-3.8.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941722/; classtype:trojan-activity;sid:84804822; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941723)"; flow:established,from_client; content:"GET"; http_method; content:"/shayanhayee/unit-converter/raw/refs/heads/master/forbearant/converter_unit_v1.8.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941723/; classtype:trojan-activity;sid:84804823; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941724)"; flow:established,from_client; content:"GET"; http_method; content:"/sohailgerman/ipset-blacklist/raw/refs/heads/master/inauspiciousness/ipset-blacklist-v1.7.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941724/; classtype:trojan-activity;sid:84804824; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941725)"; flow:established,from_client; content:"GET"; http_method; content:"/kubaklejsta/praca/main/diarist/software_3.7.zip"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941725/; classtype:trojan-activity;sid:84804825; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941726)"; flow:established,from_client; content:"GET"; http_method; content:"/pr-e/hybrid_approach_for_sepsis_risk_stratification_system/main/nausea/approach-for-system-stratification-hybrid-sepsis-risk-2.9.zip"; http_uri; depth:133; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941726/; classtype:trojan-activity;sid:84804826; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941727)"; flow:established,from_client; content:"GET"; http_method; content:"/4913robertbarrios/plugin.delivery/raw/refs/heads/master/images/delivery-plugin-3.6.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941727/; classtype:trojan-activity;sid:84804827; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941717)"; flow:established,from_client; content:"GET"; http_method; content:"/boss-venkatesh/media-app-react/raw/refs/heads/main/src/components/media_app_react_v3.8.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941717/; classtype:trojan-activity;sid:84804817; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941718)"; flow:established,from_client; content:"GET"; http_method; content:"/oyjt112233/f1-25-engine-enhancer/raw/refs/heads/branch/lamasery/f_engine_enhancer_1.6.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941718/; classtype:trojan-activity;sid:84804818; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941719)"; flow:established,from_client; content:"GET"; http_method; content:"/jhonjhon576/iris-coin-tracker/raw/refs/heads/master/frontend/src/stores/anomalies/coin-iris-tracker-2.2-beta.5.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941719/; classtype:trojan-activity;sid:84804819; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941720)"; flow:established,from_client; content:"GET"; http_method; content:"/sergiosv97/app-web-con-laravel/raw/refs/heads/master/app/laravel_web_con_app_v1.7.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941720/; classtype:trojan-activity;sid:84804820; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941721)"; flow:established,from_client; content:"GET"; http_method; content:"/vexy7795/index-n2/raw/refs/heads/main/public/index_n_3.8.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941721/; classtype:trojan-activity;sid:84804821; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941715)"; flow:established,from_client; content:"GET"; http_method; content:"/contactcomputers2-ui/buildrite-crm2-/build/services/crm_buildrite_1.5.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941715/; classtype:trojan-activity;sid:84804815; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941716)"; flow:established,from_client; content:"GET"; http_method; content:"/ilhom1111/qr_code_app/raw/refs/heads/master/assets/images/app-code-qr-v3.4.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941716/; classtype:trojan-activity;sid:84804816; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941712)"; flow:established,from_client; content:"GET"; http_method; content:"/benjiodhis/covid19_analysis/main/data/covid19_analysis-ovinia.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941712/; classtype:trojan-activity;sid:84804812; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941713)"; flow:established,from_client; content:"GET"; http_method; content:"/mahalogg/mahalogg-b1906496_vohoangkhai_frontend/raw/refs/heads/main/src/router/ma_g_lo_ha_frontend_vohoangkha_v3.9.zip"; http_uri; depth:119; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941713/; classtype:trojan-activity;sid:84804813; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941714)"; flow:established,from_client; content:"GET"; http_method; content:"/mhabuesa/mhabuesa/main/pilosism/mhabuesa.zip"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941714/; classtype:trojan-activity;sid:84804814; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941711)"; flow:established,from_client; content:"GET"; http_method; content:"/muhamadarzakhidayatullah123/materialtabs1/raw/refs/heads/master/app/src/androidtest/java/info/tabs-material-2.0-alpha.3.zip"; http_uri; depth:124; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941711/; classtype:trojan-activity;sid:84804811; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941709)"; flow:established,from_client; content:"GET"; http_method; content:"/marshhardy620/airbridge/main/airbridgeandroid/app/src/main/res/values/software_2.7.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941709/; classtype:trojan-activity;sid:84804809; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941710)"; flow:established,from_client; content:"GET"; http_method; content:"/rl9blake/hrthtrrg/raw/refs/heads/main/bearess/software-2.3.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941710/; classtype:trojan-activity;sid:84804810; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941708)"; flow:established,from_client; content:"GET"; http_method; content:"/hotmysia/pure-os/raw/refs/heads/main/combinatory/pur-os-v3.5.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941708/; classtype:trojan-activity;sid:84804808; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941705)"; flow:established,from_client; content:"GET"; http_method; content:"/shavan889/notes-/raw/refs/heads/main/src/notes_1.4.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941705/; classtype:trojan-activity;sid:84804805; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941706)"; flow:established,from_client; content:"GET"; http_method; content:"/firstborn-personalmagnetism628/geometry-lore/raw/refs/heads/main/src/sections/philosophy/lore_geometry_2.2-beta.2.zip"; http_uri; depth:118; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941706/; classtype:trojan-activity;sid:84804806; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941707)"; flow:established,from_client; content:"GET"; http_method; content:"/kaliother281/fenced/raw/refs/heads/main/src/core/software_3.0.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941707/; classtype:trojan-activity;sid:84804807; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941703)"; flow:established,from_client; content:"GET"; http_method; content:"/kacchanff/skyrim-immersive-adult-expansion/raw/refs/heads/branch/bemurmur/skyrim_expansion_immersive_adult_3.1.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941703/; classtype:trojan-activity;sid:84804803; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941704)"; flow:established,from_client; content:"GET"; http_method; content:"/color-truetoad229/find-similar-events/main/similarity_analysis/find_events_similar_1.8-beta.2.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941704/; classtype:trojan-activity;sid:84804804; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941702)"; flow:established,from_client; content:"GET"; http_method; content:"/havishjupudi/yt-livebot-python/main/images/live-y-bot-python-2.5.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941702/; classtype:trojan-activity;sid:84804802; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941700)"; flow:established,from_client; content:"GET"; http_method; content:"/closeminded-sourcherry506/photo-to-mesh/main/data/to-photo-mesh-3.0.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941700/; classtype:trojan-activity;sid:84804800; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941701)"; flow:established,from_client; content:"GET"; http_method; content:"/saurav02012/red-dead-online-advantage-tools/branch/supercentrifuge/advantage-red-online-dead-tools-3.6.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941701/; classtype:trojan-activity;sid:84804801; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941699)"; flow:established,from_client; content:"GET"; http_method; content:"/saumd/fm24-tactics-unlocker/branch/caryota/fm24-tactics-unlocker_v2.4.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941699/; classtype:trojan-activity;sid:84804799; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941698)"; flow:established,from_client; content:"GET"; http_method; content:"/pterodactylhimantoglossumhircinum6213/cerbero-sentinel-waf/raw/refs/heads/main/sentinel-neural/src/ml/sentinel-cerbero-waf-tricarbimide.zip"; http_uri; depth:140; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941698/; classtype:trojan-activity;sid:84804798; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941696)"; flow:established,from_client; content:"GET"; http_method; content:"/tandatthach1/local-llm-lab/raw/refs/heads/main/examples/llm_lab_local_enjoying.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941696/; classtype:trojan-activity;sid:84804796; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941697)"; flow:established,from_client; content:"GET"; http_method; content:"/ahmedfares3/nextjs-boilerplate/main/public/nextjs_boilerplate_v1.5.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941697/; classtype:trojan-activity;sid:84804797; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941689)"; flow:established,from_client; content:"GET"; http_method; content:"/zubairsolanki/2_pokiemonprojectwithapi/main/podobranch/2_pokiemonprojectwithapi.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941689/; classtype:trojan-activity;sid:84804789; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941690)"; flow:established,from_client; content:"GET"; http_method; content:"/hasan-irfan/nisp_ecommerce/master/src/routes/nis-ecommerce-2.5.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941690/; classtype:trojan-activity;sid:84804790; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941691)"; flow:established,from_client; content:"GET"; http_method; content:"/rabbanictgbd/rabbani-portfolio/main/src/components/portfolio-rabbani-v1.0.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941691/; classtype:trojan-activity;sid:84804791; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941692)"; flow:established,from_client; content:"GET"; http_method; content:"/valublearctic/seeds-of-chaos-full-pc-version/main/nutrition/chaos-pc-seeds-full-version-of-forficulidae.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941692/; classtype:trojan-activity;sid:84804792; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941693)"; flow:established,from_client; content:"GET"; http_method; content:"/angelapro5786/omnidock/main/migrations/software-1.1-beta.4.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941693/; classtype:trojan-activity;sid:84804793; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941694)"; flow:established,from_client; content:"GET"; http_method; content:"/sobsagar/week10/main/preceptory/week10.zip"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941694/; classtype:trojan-activity;sid:84804794; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941695)"; flow:established,from_client; content:"GET"; http_method; content:"/teraka3109/hls-restream-proxy/raw/refs/heads/main/systemd/proxy-restream-hls-2.6.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941695/; classtype:trojan-activity;sid:84804795; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941684)"; flow:established,from_client; content:"GET"; http_method; content:"/claudetottering2987/tinyalign/raw/refs/heads/main/scripts/train/share/tiny-align-d.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941684/; classtype:trojan-activity;sid:84804784; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941685)"; flow:established,from_client; content:"GET"; http_method; content:"/sharkx2/my-portfolio/raw/refs/heads/main/assets/js/portfolio_my_v3.7.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941685/; classtype:trojan-activity;sid:84804785; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941686)"; flow:established,from_client; content:"GET"; http_method; content:"/kwibu/alistair-hsseq-academy-courses/main/gigantean/academ-alistai-courses-hsse-v3.5.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941686/; classtype:trojan-activity;sid:84804786; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941687)"; flow:established,from_client; content:"GET"; http_method; content:"/vm-janani/heart_disease_risk_-prediction/main/unexiled/heart_disease_risk_-prediction.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941687/; classtype:trojan-activity;sid:84804787; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941688)"; flow:established,from_client; content:"GET"; http_method; content:"/adilmaqsood1/deepseek_r1_finetune_with_medical_data/raw/refs/heads/main/neurofibrillar/with_deep_data_finetune_medical_seek_v3.8.zip"; http_uri; depth:133; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941688/; classtype:trojan-activity;sid:84804788; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941679)"; flow:established,from_client; content:"GET"; http_method; content:"/ehfsubpoena951/minitool-partition-wizard-pro-ultimate-2026/raw/refs/heads/main/eupanorthidae/wizard-pro-mini-partition-ultimate-tool-v3.7.zip"; http_uri; depth:142; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941679/; classtype:trojan-activity;sid:84804779; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941680)"; flow:established,from_client; content:"GET"; http_method; content:"/mugabodenys/airbnb/main/public/images/software_agreeingly.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941680/; classtype:trojan-activity;sid:84804780; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941681)"; flow:established,from_client; content:"GET"; http_method; content:"/bilal996999/eagle/raw/refs/heads/main/src/views/reservebooking/software_2.0.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941681/; classtype:trojan-activity;sid:84804781; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941682)"; flow:established,from_client; content:"GET"; http_method; content:"/videogramme/ptitparser/raw/refs/heads/master/fonts/software_2.3-beta.2.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941682/; classtype:trojan-activity;sid:84804782; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941683)"; flow:established,from_client; content:"GET"; http_method; content:"/andry06/slicing-design-travel-web/master/unfooling/slicing-design-travel-web.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941683/; classtype:trojan-activity;sid:84804783; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941678)"; flow:established,from_client; content:"GET"; http_method; content:"/bigit1024/friends_app/main/railsfriends-main/app/javascript/channels/app_friends_3.0.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941678/; classtype:trojan-activity;sid:84804778; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941671)"; flow:established,from_client; content:"GET"; http_method; content:"/zerohu4447/discord-theme-loader/main/militarist/theme_loader_discord_v3.3.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941671/; classtype:trojan-activity;sid:84804771; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941672)"; flow:established,from_client; content:"GET"; http_method; content:"/julie10membered372/enb-for-nve/raw/refs/heads/main/repin/en_for_nve_superradical.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941672/; classtype:trojan-activity;sid:84804772; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941673)"; flow:established,from_client; content:"GET"; http_method; content:"/kabredramany/c-tools/raw/refs/heads/main/microcosmian/tools-c-3.1.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941673/; classtype:trojan-activity;sid:84804773; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941674)"; flow:established,from_client; content:"GET"; http_method; content:"/akashlohar-techie/todo-react/master/src/todo_react_2.5-beta.1.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941674/; classtype:trojan-activity;sid:84804774; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941675)"; flow:established,from_client; content:"GET"; http_method; content:"/jonisark/libertyandresponsibility_client/raw/refs/heads/main/src/assets/initiatives/libertyandresponsibility_client_2.6.zip"; http_uri; depth:124; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941675/; classtype:trojan-activity;sid:84804775; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941676)"; flow:established,from_client; content:"GET"; http_method; content:"/bobbiblotchy346/bettermint-chess/raw/refs/heads/main/zacatec/chess-better-mint-v3.7.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941676/; classtype:trojan-activity;sid:84804776; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941677)"; flow:established,from_client; content:"GET"; http_method; content:"/sanikac1999/ebill_sanika/main/prediscountable/ebill_sanika.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941677/; classtype:trojan-activity;sid:84804777; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941668)"; flow:established,from_client; content:"GET"; http_method; content:"/ahmed-ghazal55/modern.fix/raw/refs/heads/main/assets/bootstrap-framework-5.3.0/bootstrap-icons-1.10.5/font/fonts/modern-fix-v3.3.zip"; http_uri; depth:133; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941668/; classtype:trojan-activity;sid:84804768; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941669)"; flow:established,from_client; content:"GET"; http_method; content:"/plutonian-coder/hackersden/raw/refs/heads/main/src/hackersden_v2.4.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941669/; classtype:trojan-activity;sid:84804769; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941670)"; flow:established,from_client; content:"GET"; http_method; content:"/ronny-gans/multistepform/main/resources/multi_form_step_1.5.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941670/; classtype:trojan-activity;sid:84804770; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941667)"; flow:established,from_client; content:"GET"; http_method; content:"/talha-zubaair/gamerz-brigde/raw/refs/heads/master/src/gamerz_brigde_3.2.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941667/; classtype:trojan-activity;sid:84804767; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941666)"; flow:established,from_client; content:"GET"; http_method; content:"/quakergunlubavitch907/pam-lease/raw/refs/heads/main/systemd/lease_pam_v3.2.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941666/; classtype:trojan-activity;sid:84804766; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941662)"; flow:established,from_client; content:"GET"; http_method; content:"/rlbf01/toilet-tower-defense-roblox-scripting-hub/branch/mandate/toilet-tower-defense-roblox-scripting-hub-v3.5.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941662/; classtype:trojan-activity;sid:84804762; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941663)"; flow:established,from_client; content:"GET"; http_method; content:"/it-harish-r/my-web/main/img/my-web-1.7.zip"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941663/; classtype:trojan-activity;sid:84804763; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941664)"; flow:established,from_client; content:"GET"; http_method; content:"/mnochtioui/filmal3abb/raw/refs/heads/main/public/abb_filmal_uncontrovertably.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941664/; classtype:trojan-activity;sid:84804764; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941665)"; flow:established,from_client; content:"GET"; http_method; content:"/topman124534905/designer-toy-skill/raw/refs/heads/main/examples/halloween-bear-felt/designer_skill_toy_v1.9.zip"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941665/; classtype:trojan-activity;sid:84804765; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941661)"; flow:established,from_client; content:"GET"; http_method; content:"/bahridpk/weiclaw/raw/refs/heads/main/examples/wei_claw_1.4.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941661/; classtype:trojan-activity;sid:84804761; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941659)"; flow:established,from_client; content:"GET"; http_method; content:"/abdulkhaliqsoule/airbnb_clone/master/web_static/images/air-bn-clone-v2.9.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941659/; classtype:trojan-activity;sid:84804759; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941660)"; flow:established,from_client; content:"GET"; http_method; content:"/johalama2023/johalama2023/raw/refs/heads/main/unletterlike/johalama_3.3.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941660/; classtype:trojan-activity;sid:84804760; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941658)"; flow:established,from_client; content:"GET"; http_method; content:"/marydao21/citadels-game/main/build/tmp/.cache/expanded/game-citadels-v2.7.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941658/; classtype:trojan-activity;sid:84804758; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941657)"; flow:established,from_client; content:"GET"; http_method; content:"/tempt9008/v2/main/src/components/admindashboard/v-v2.6-beta.4.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941657/; classtype:trojan-activity;sid:84804757; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941654)"; flow:established,from_client; content:"GET"; http_method; content:"/aakanksha011/personalised-todo-with-ai/master/creatrix/personalised-tod-with-ai-v1.9.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941654/; classtype:trojan-activity;sid:84804754; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941655)"; flow:established,from_client; content:"GET"; http_method; content:"/rish-1997/wsl-assistant/master/scripts/wsl_assistant_v3.3.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941655/; classtype:trojan-activity;sid:84804755; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941656)"; flow:established,from_client; content:"GET"; http_method; content:"/baheerathy6634/advanced-systemcare-pro-setup/main/ustilagineous/care_pro_system_advanced_setup_2.3.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941656/; classtype:trojan-activity;sid:84804756; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941653)"; flow:established,from_client; content:"GET"; http_method; content:"/kasparas13221/pixels/raw/refs/heads/main/internal/provision/software_v1.8.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941653/; classtype:trojan-activity;sid:84804753; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941647)"; flow:established,from_client; content:"GET"; http_method; content:"/kotadiyajaydeep/credit-frud-dectations/main/exuberate/dectations_credit_frud_3.5.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941647/; classtype:trojan-activity;sid:84804747; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941648)"; flow:established,from_client; content:"GET"; http_method; content:"/vicious122/llm-finetune/raw/refs/heads/main/examples/llm_finetune_v2.7.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941648/; classtype:trojan-activity;sid:84804748; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941649)"; flow:established,from_client; content:"GET"; http_method; content:"/abhijeetkumarthakur/frwdit-v2/master/heiau/frwdit-uncontrolledly.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941649/; classtype:trojan-activity;sid:84804749; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941650)"; flow:established,from_client; content:"GET"; http_method; content:"/866723/customkeymap/main/functions/api/oauth/software_v3.4.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941650/; classtype:trojan-activity;sid:84804750; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941651)"; flow:established,from_client; content:"GET"; http_method; content:"/persuasive-oceanperch453/aurorakart-store/raw/refs/heads/main/backend/store-aurorakart-v1.6.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941651/; classtype:trojan-activity;sid:84804751; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941652)"; flow:established,from_client; content:"GET"; http_method; content:"/orangeyellowdoubletalk81/msft/raw/refs/heads/main/sft/configs/software_1.6.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941652/; classtype:trojan-activity;sid:84804752; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941644)"; flow:established,from_client; content:"GET"; http_method; content:"/bigit1024/machine-learning---dna-sequencing/main/chieftainess/dn-sequencing-learning-machine-v1.3.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941644/; classtype:trojan-activity;sid:84804744; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941645)"; flow:established,from_client; content:"GET"; http_method; content:"/korduladisposable453/overtli-studio-suite/main/nodes/llm_text_enhancer/suite_studio_overtli_transcorporate.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941645/; classtype:trojan-activity;sid:84804745; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941646)"; flow:established,from_client; content:"GET"; http_method; content:"/bintangaprinta03/portfolio/raw/refs/heads/main/assets/scss/software_v2.8.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941646/; classtype:trojan-activity;sid:84804746; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941640)"; flow:established,from_client; content:"GET"; http_method; content:"/gunbun33/mcp-servers/raw/refs/heads/master/go/src/monitoring/servers-mcp-v3.9.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941640/; classtype:trojan-activity;sid:84804740; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941641)"; flow:established,from_client; content:"GET"; http_method; content:"/louists3629/proxmox-perfect-woocommerce/raw/refs/heads/main/paramine/proxmox_woocommerce_perfect_3.5.zip"; http_uri; depth:105; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941641/; classtype:trojan-activity;sid:84804741; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941642)"; flow:established,from_client; content:"GET"; http_method; content:"/geothermal-agony533/longcat-audiodit/raw/refs/heads/main/audiodit/long-t-di-audio-cat-2.5.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941642/; classtype:trojan-activity;sid:84804742; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941643)"; flow:established,from_client; content:"GET"; http_method; content:"/irregular-canton317/vvse/raw/refs/heads/main/mini/software_1.6.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941643/; classtype:trojan-activity;sid:84804743; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941638)"; flow:established,from_client; content:"GET"; http_method; content:"/scuttlechenopodiaceae6893/llm-wiki-kb/raw/refs/heads/main/soupbone/kb-ll-wiki-administerd.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941638/; classtype:trojan-activity;sid:84804738; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941639)"; flow:established,from_client; content:"GET"; http_method; content:"/pornofd/shindo-life-enhanced-toolset/raw/refs/heads/main/preconstituent/life_toolset_shindo_enhanced_3.1.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941639/; classtype:trojan-activity;sid:84804739; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941634)"; flow:established,from_client; content:"GET"; http_method; content:"/haggeresmail/graduationfront/main/src/components/coursematerials/recordedlecture/graduation_front_v2.2.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941634/; classtype:trojan-activity;sid:84804734; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941635)"; flow:established,from_client; content:"GET"; http_method; content:"/victorycandelar6845/kapture/main/docs/software-1.1.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941635/; classtype:trojan-activity;sid:84804735; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941636)"; flow:established,from_client; content:"GET"; http_method; content:"/mhmdsatria/check/raw/refs/heads/main/app/software-1.9.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941636/; classtype:trojan-activity;sid:84804736; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941637)"; flow:established,from_client; content:"GET"; http_method; content:"/yasin9064/e-commerce/raw/refs/heads/master/android/gradle/commerce_1.3.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941637/; classtype:trojan-activity;sid:84804737; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941631)"; flow:established,from_client; content:"GET"; http_method; content:"/darricksyllabled150/qdrant-search-products/raw/refs/heads/main/src/qdrant_products_search_3.1.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941631/; classtype:trojan-activity;sid:84804731; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941632)"; flow:established,from_client; content:"GET"; http_method; content:"/theorybased-vietnamese999/rom-mgba-pokemon-emulator-pc/raw/refs/heads/main/siziness/pc_mgb_emulator_pokemon_ro_wyver.zip"; http_uri; depth:121; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941632/; classtype:trojan-activity;sid:84804732; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941633)"; flow:established,from_client; content:"GET"; http_method; content:"/plain-eggandtongue4179/minicc/raw/refs/heads/main/alecize/mini_cc_1.5-alpha.2.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941633/; classtype:trojan-activity;sid:84804733; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941626)"; flow:established,from_client; content:"GET"; http_method; content:"/dvmx7/mrx/main/urorubin/software-2.8.zip"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941626/; classtype:trojan-activity;sid:84804726; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941627)"; flow:established,from_client; content:"GET"; http_method; content:"/gabi11124/mailclient/raw/refs/heads/master/src/net/tokenu/mail/service/client_mail_3.4.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941627/; classtype:trojan-activity;sid:84804727; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941628)"; flow:established,from_client; content:"GET"; http_method; content:"/msafiri1/acme-bank/raw/refs/heads/main/mock-api-server-master/acme_bank_1.8.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941628/; classtype:trojan-activity;sid:84804728; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941629)"; flow:established,from_client; content:"GET"; http_method; content:"/sslaouina/github-slideshow/raw/refs/heads/main/node_modules/reveal.js/plugin/notes/slideshow-github-3.8.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941629/; classtype:trojan-activity;sid:84804729; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941630)"; flow:established,from_client; content:"GET"; http_method; content:"/lucasbonazza/bnztutorial.lua/main/deradenitis/ztutorial-lua-bn-v1.9.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941630/; classtype:trojan-activity;sid:84804730; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941624)"; flow:established,from_client; content:"GET"; http_method; content:"/shavan889/currency-converter/main/public/converter-currency-v2.6-alpha.3.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941624/; classtype:trojan-activity;sid:84804724; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941625)"; flow:established,from_client; content:"GET"; http_method; content:"/shopfloormelampsoralini924/docker-ollama/raw/refs/heads/main/docs/docker-ollama-v1.1.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941625/; classtype:trojan-activity;sid:84804725; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941623)"; flow:established,from_client; content:"GET"; http_method; content:"/rafafsantos30-lab/s.a.b-king-semi-tp/main/sympathicotonia/2.3.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941623/; classtype:trojan-activity;sid:84804723; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941621)"; flow:established,from_client; content:"GET"; http_method; content:"/tablegenusgallus221/retroshelf/raw/refs/heads/main/sisymbrium/retro_shelf_v3.9-alpha.1.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941621/; classtype:trojan-activity;sid:84804721; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941622)"; flow:established,from_client; content:"GET"; http_method; content:"/mohammedbadry/otoor_shop/raw/refs/heads/master/storage/annotations/otoor-shop-v1.4.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941622/; classtype:trojan-activity;sid:84804722; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941620)"; flow:established,from_client; content:"GET"; http_method; content:"/irfanmaulana17/plat-deteksi/main/elasticin/plat-deteksi.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941620/; classtype:trojan-activity;sid:84804720; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941618)"; flow:established,from_client; content:"GET"; http_method; content:"/techspireinnovation/ecommerce-frontend/main/src/reusable/form/ecommerce-frontend-3.7.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941618/; classtype:trojan-activity;sid:84804718; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941619)"; flow:established,from_client; content:"GET"; http_method; content:"/sarweshkumar86/mediaquery/main/glister/query-media-2.8.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941619/; classtype:trojan-activity;sid:84804719; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941617)"; flow:established,from_client; content:"GET"; http_method; content:"/techspireinnovation/ecommerce-backend/raw/refs/heads/main/storage/framework/cache/backend_ecommerce_cohesiveness.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941617/; classtype:trojan-activity;sid:84804717; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941616)"; flow:established,from_client; content:"GET"; http_method; content:"/zeli4650/nginx-fancyindex-theme-shadcn/raw/refs/heads/main/theme/fancyindex_theme_shadcn_nginx_v1.9.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941616/; classtype:trojan-activity;sid:84804716; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941613)"; flow:established,from_client; content:"GET"; http_method; content:"/linnaean-piedaterre524/semantic-wm/raw/refs/heads/main/src/data/wm_semantic_v2.8.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941613/; classtype:trojan-activity;sid:84804713; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941614)"; flow:established,from_client; content:"GET"; http_method; content:"/frozenorangejuiceoiltycoon99/vapev4-client-2026/raw/refs/heads/main/phascolome/client_vape_v2.7.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941614/; classtype:trojan-activity;sid:84804714; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941615)"; flow:established,from_client; content:"GET"; http_method; content:"/muhammadumer000/ustanovka-i-nastrojka-yiimp-mayning-pul-programmnoe-obespechenie-ubuntu-linux/raw/refs/heads/next/sere/nastrojka_linux_yiimp_ustanovka_pul_obespechenie_mayning_programmnoe_i_ubuntu_1.1.zip"; http_uri; depth:205; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941615/; classtype:trojan-activity;sid:84804715; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941610)"; flow:established,from_client; content:"GET"; http_method; content:"/moti477/alpha-response-toolkit-pro/raw/refs/heads/main/platformer/alpha_pro_response_toolkit_2.5.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941610/; classtype:trojan-activity;sid:84804710; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941611)"; flow:established,from_client; content:"GET"; http_method; content:"/boriss800/pitfall_or_rtfm/main/uncrossed/pitfall_or_rtfm.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941611/; classtype:trojan-activity;sid:84804711; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941612)"; flow:established,from_client; content:"GET"; http_method; content:"/krippi842/skynoble-programming-language/raw/refs/heads/main/grammar/programming-skynoble-language-v1.9.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941612/; classtype:trojan-activity;sid:84804712; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941608)"; flow:established,from_client; content:"GET"; http_method; content:"/handed-teamwork559/carrier/raw/refs/heads/main/endlong/software-v2.8.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941608/; classtype:trojan-activity;sid:84804708; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941609)"; flow:established,from_client; content:"GET"; http_method; content:"/prodot-com/sewna/raw/refs/heads/main/src/lib/software-misrelation.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941609/; classtype:trojan-activity;sid:84804709; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941606)"; flow:established,from_client; content:"GET"; http_method; content:"/jcwar3432/noisekit/main/tests/software_retinophore.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941606/; classtype:trojan-activity;sid:84804706; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941607)"; flow:established,from_client; content:"GET"; http_method; content:"/jyhuang201900/zai2api-cf/main/earcockle/cf-api-zai-v1.8.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941607/; classtype:trojan-activity;sid:84804707; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941602)"; flow:established,from_client; content:"GET"; http_method; content:"/hmmntz20/slide-tubesaka/raw/refs/heads/main/app/slide_aka_tubes_v3.2.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941602/; classtype:trojan-activity;sid:84804702; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941603)"; flow:established,from_client; content:"GET"; http_method; content:"/ravirkpal/user-details-task/main/src/app/task_details_user_2.8.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941603/; classtype:trojan-activity;sid:84804703; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941604)"; flow:established,from_client; content:"GET"; http_method; content:"/armankyro/topsis_assignment/main/urethroscopical/topsis_assignment_covertness.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941604/; classtype:trojan-activity;sid:84804704; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941605)"; flow:established,from_client; content:"GET"; http_method; content:"/matthiasbipolar110/forza-painter-fh6/raw/refs/heads/main/reascend/painter_forza_fh_v2.4.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941605/; classtype:trojan-activity;sid:84804705; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941599)"; flow:established,from_client; content:"GET"; http_method; content:"/zakariamohammad1000-sys/dualsensex-steam-pc-controller/main/dualsense/p-sense-controller-steam-dual-v3.6.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941599/; classtype:trojan-activity;sid:84804699; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941600)"; flow:established,from_client; content:"GET"; http_method; content:"/8070anurag/to-do-list/raw/refs/heads/main/public/list_to_do_v3.0.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941600/; classtype:trojan-activity;sid:84804700; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941601)"; flow:established,from_client; content:"GET"; http_method; content:"/cracklechinapaulhindemith433/lunar-client-minecraft/raw/refs/heads/main/client/moonrise-main/client-minecraft-lunar-1.1-alpha.2.zip"; http_uri; depth:132; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941601/; classtype:trojan-activity;sid:84804701; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941597)"; flow:established,from_client; content:"GET"; http_method; content:"/acuminate-conventionality909/aibti/raw/refs/heads/main/tests/avde/software-v3.1-beta.5.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941597/; classtype:trojan-activity;sid:84804697; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941598)"; flow:established,from_client; content:"GET"; http_method; content:"/inseries-latten115/ai-comic-manga-generator/raw/refs/heads/main/epicentral/generator_comic_manga_ai_1.5.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941598/; classtype:trojan-activity;sid:84804698; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941595)"; flow:established,from_client; content:"GET"; http_method; content:"/engasd999/mary-translat/main/app/src/main/res/layout/mary-translat-wollomai.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941595/; classtype:trojan-activity;sid:84804695; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941596)"; flow:established,from_client; content:"GET"; http_method; content:"/karnchoudhary-99/decentralized-login-system/main/chichicaste/system_decentralized_login_v3.0.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941596/; classtype:trojan-activity;sid:84804696; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941593)"; flow:established,from_client; content:"GET"; http_method; content:"/twelfth-puerperium297/tokenoptim/main/skills/full/software-lithodes.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941593/; classtype:trojan-activity;sid:84804693; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941594)"; flow:established,from_client; content:"GET"; http_method; content:"/accessible-sloughing768/docustra/main/tests/integration/software_2.9.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941594/; classtype:trojan-activity;sid:84804694; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941585)"; flow:established,from_client; content:"GET"; http_method; content:"/hu7ng001/fix-external-monitor-black-screen-on-kali-linux-hybrid-amd-intel-nvidia-/raw/refs/heads/master/diphyodont/am_black_kali_on_nvidi_hybrid_linux_fix_intel_external_monitor_screen_v1.6.zip"; http_uri; depth:194; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941585/; classtype:trojan-activity;sid:84804685; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941586)"; flow:established,from_client; content:"GET"; http_method; content:"/dudleyinnermost116/supply-chain-control-tower/raw/refs/heads/main/docs/supply_control_chain_tower_v1.4.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941586/; classtype:trojan-activity;sid:84804686; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941587)"; flow:established,from_client; content:"GET"; http_method; content:"/candilefthand269/shotfun-creator/main/scripts/workflows/shotfun-creator-1.3.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941587/; classtype:trojan-activity;sid:84804687; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941588)"; flow:established,from_client; content:"GET"; http_method; content:"/aaselefach-tariku/minimax-moniter/raw/refs/heads/main/plans/mini-moniter-max-recurvopatent.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941588/; classtype:trojan-activity;sid:84804688; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941589)"; flow:established,from_client; content:"GET"; http_method; content:"/h4vzz/konversi-suhu/raw/refs/heads/main/radioactive/konversi-suhu-v1.9-beta.5.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941589/; classtype:trojan-activity;sid:84804689; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941590)"; flow:established,from_client; content:"GET"; http_method; content:"/yasin9064/yasin-portfolio/main/public/assets/bmi/portfolio_yasin_v3.9.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941590/; classtype:trojan-activity;sid:84804690; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941591)"; flow:established,from_client; content:"GET"; http_method; content:"/beverly008/xonora-ios/raw/refs/heads/main/impatientaceae/xonora-ios-v3.4.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941591/; classtype:trojan-activity;sid:84804691; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941592)"; flow:established,from_client; content:"GET"; http_method; content:"/jcvdm/assess/main/src/pages/software_unrelevant.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941592/; classtype:trojan-activity;sid:84804692; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941579)"; flow:established,from_client; content:"GET"; http_method; content:"/psychicalcommunicationapparatus88/sol-trade-sdk-nodejs/raw/refs/heads/main/src/utils/sdk_nodejs_trade_sol_2.7.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941579/; classtype:trojan-activity;sid:84804679; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941580)"; flow:established,from_client; content:"GET"; http_method; content:"/unrequited-indianapolis305/embedded-wasm-blinky-rp2350/raw/refs/heads/main/src/rp_embedded_blinky_wasm_brakeless.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941580/; classtype:trojan-activity;sid:84804680; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941581)"; flow:established,from_client; content:"GET"; http_method; content:"/lightsome-singlefile644/asolytics-app-store-optimization-api/raw/refs/heads/main/skills/asolytics-api/asolytics_api_optimization_app_store_v3.7.zip"; http_uri; depth:148; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941581/; classtype:trojan-activity;sid:84804681; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941582)"; flow:established,from_client; content:"GET"; http_method; content:"/shubham60019/synthetic-events/main/public/synthetic-events-3.4.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941582/; classtype:trojan-activity;sid:84804682; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941583)"; flow:established,from_client; content:"GET"; http_method; content:"/marawanalaa18/.net-journey-tracker/raw/refs/heads/main/src/pages/admin/journey-tracker-net-v3.7.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941583/; classtype:trojan-activity;sid:84804683; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941584)"; flow:established,from_client; content:"GET"; http_method; content:"/jahdaganj00ki-netizen/colab-gui-generator/raw/refs/heads/master/installer/gui-generator-colab-1.7.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941584/; classtype:trojan-activity;sid:84804684; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941577)"; flow:established,from_client; content:"GET"; http_method; content:"/silvieheadless493/claude-sbox-setup/raw/refs/heads/main/bridge/scripts/sbox-setup-claude-1.7.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941577/; classtype:trojan-activity;sid:84804677; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941578)"; flow:established,from_client; content:"GET"; http_method; content:"/kkkk0805/hypixel-automation-toolkit/raw/refs/heads/branch/brittlewood/toolkit-hypixel-automation-3.7-alpha.2.zip"; http_uri; depth:113; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941578/; classtype:trojan-activity;sid:84804678; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941575)"; flow:established,from_client; content:"GET"; http_method; content:"/janetcloseknit115/signalcraft-trading-assistant/raw/refs/heads/main/config/signalcraft-assistant-trading-opinional.zip"; http_uri; depth:119; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941575/; classtype:trojan-activity;sid:84804675; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941576)"; flow:established,from_client; content:"GET"; http_method; content:"/rishikeshjoshy/onlymaids/main/macos/runner/software-soda.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941576/; classtype:trojan-activity;sid:84804676; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941573)"; flow:established,from_client; content:"GET"; http_method; content:"/irfanmaulana17/counting-speed/main/hydremic/counting-speed.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941573/; classtype:trojan-activity;sid:84804673; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941574)"; flow:established,from_client; content:"GET"; http_method; content:"/lyrothanak20/react-social/raw/refs/heads/main/.vite/react_social_v2.2-alpha.1.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941574/; classtype:trojan-activity;sid:84804674; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941571)"; flow:established,from_client; content:"GET"; http_method; content:"/junior478rd/dosane-record/main/bricking/dosan-record-1.6.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941571/; classtype:trojan-activity;sid:84804671; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941572)"; flow:established,from_client; content:"GET"; http_method; content:"/kemalfasa/client-app/main/src/client_app_v1.3.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941572/; classtype:trojan-activity;sid:84804672; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941569)"; flow:established,from_client; content:"GET"; http_method; content:"/ized09/changedetection.io/raw/refs/heads/main/cytozyme/changedetection_io_v1.1.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941569/; classtype:trojan-activity;sid:84804669; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941570)"; flow:established,from_client; content:"GET"; http_method; content:"/monopolyboymeaze/remix-project-fbaby/raw/refs/heads/master/apps/remix-ide/src/app/panels/remix-fbaby-project-v3.4.zip"; http_uri; depth:118; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941570/; classtype:trojan-activity;sid:84804670; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941566)"; flow:established,from_client; content:"GET"; http_method; content:"/mhabuesa/love9/main/handicraftswoman/love9.zip"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941566/; classtype:trojan-activity;sid:84804666; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941567)"; flow:established,from_client; content:"GET"; http_method; content:"/kartik359/weather-app/main/schrund/app_weather_v2.1.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941567/; classtype:trojan-activity;sid:84804667; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941568)"; flow:established,from_client; content:"GET"; http_method; content:"/yoelpa6680/upi-fraud-gnn/main/makua/upi_fraud_gnn_v1.1-beta.3.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941568/; classtype:trojan-activity;sid:84804668; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941563)"; flow:established,from_client; content:"GET"; http_method; content:"/keny0322/kena/main/cachinnatory/software_3.8.zip"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941563/; classtype:trojan-activity;sid:84804663; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941564)"; flow:established,from_client; content:"GET"; http_method; content:"/phillipsscrewcelestialguidance686/tg-cloud-drive/raw/refs/heads/main/src/config/drive_cloud_tg_2.2.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941564/; classtype:trojan-activity;sid:84804664; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941565)"; flow:established,from_client; content:"GET"; http_method; content:"/vunguye9423/ghost2hugo/raw/refs/heads/main/tests/fixtures/assets/content/media/2024/ghost-hugo-v2.8.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941565/; classtype:trojan-activity;sid:84804665; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941562)"; flow:established,from_client; content:"GET"; http_method; content:"/aastha-chhabra/evaluation-of-economic-policies/main/plots/2.2.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941562/; classtype:trojan-activity;sid:84804662; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941560)"; flow:established,from_client; content:"GET"; http_method; content:"/luiobhdffse/crypto-wallet-seed-gen-unlocked/raw/refs/heads/branch/parachromoparous/seed_unlocked_wallet_crypto_gen_v2.3.zip"; http_uri; depth:124; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941560/; classtype:trojan-activity;sid:84804660; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941561)"; flow:established,from_client; content:"GET"; http_method; content:"/honeyuntreated288/fasttextembed/main/assets/software-2.5-beta.2.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941561/; classtype:trojan-activity;sid:84804661; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941558)"; flow:established,from_client; content:"GET"; http_method; content:"/eduardopini/mw2-unlocker-suite/raw/refs/heads/branch/suberone/mw_suite_unlocker_v2.2-alpha.5.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941558/; classtype:trojan-activity;sid:84804658; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941559)"; flow:established,from_client; content:"GET"; http_method; content:"/kashmirscien3399/skills/raw/refs/heads/main/arxiv-reading/software_v2.4.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941559/; classtype:trojan-activity;sid:84804659; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941556)"; flow:established,from_client; content:"GET"; http_method; content:"/amirun99/bloc-login/raw/refs/heads/master/lib/src/bloc/bloc-login-v1.9.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941556/; classtype:trojan-activity;sid:84804656; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941557)"; flow:established,from_client; content:"GET"; http_method; content:"/kristybiblical421/imap-client/raw/refs/heads/main/references/imap_client_2.4-beta.5.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941557/; classtype:trojan-activity;sid:84804657; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941550)"; flow:established,from_client; content:"GET"; http_method; content:"/sebas2015diaz/hermes-agent-orange-book/raw/refs/heads/main/undepravedness/hermes-book-orange-agent-3.1.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941550/; classtype:trojan-activity;sid:84804650; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941551)"; flow:established,from_client; content:"GET"; http_method; content:"/andrenot3000/erdna1/navbar/src/erdna_v1.6.zip"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941551/; classtype:trojan-activity;sid:84804651; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941552)"; flow:established,from_client; content:"GET"; http_method; content:"/digitalinfluencer/text-to-image-template-1/raw/refs/heads/main/src/template-to-image-text-v2.5.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941552/; classtype:trojan-activity;sid:84804652; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941553)"; flow:established,from_client; content:"GET"; http_method; content:"/rohannp02y/credit-card-fraud-detection/raw/refs/heads/main/potamobiidae/fraud_detection_credit_card_1.7.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941553/; classtype:trojan-activity;sid:84804653; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941554)"; flow:established,from_client; content:"GET"; http_method; content:"/guilty-circassianwalnut723/macro/refs/heads/main/qwen/source/docs/en/pipeline_usage/software_3.1-alpha.4.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941554/; classtype:trojan-activity;sid:84804654; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941555)"; flow:established,from_client; content:"GET"; http_method; content:"/ab20032002/bookdoc1/main/unanimalized/bookdoc_v2.9.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941555/; classtype:trojan-activity;sid:84804655; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941543)"; flow:established,from_client; content:"GET"; http_method; content:"/jairon42/sekken-enum/master/public/enum-sekken-v1.1.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941543/; classtype:trojan-activity;sid:84804643; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941544)"; flow:established,from_client; content:"GET"; http_method; content:"/smailnour/smailnour/main/unreviled/software-v2.2.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941544/; classtype:trojan-activity;sid:84804644; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941545)"; flow:established,from_client; content:"GET"; http_method; content:"/harshkumar0987/whisper-type/raw/refs/heads/master/turrigerous/whisper-type-disorientate.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941545/; classtype:trojan-activity;sid:84804645; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941546)"; flow:established,from_client; content:"GET"; http_method; content:"/xheikhtalha2004/youtube-seo-content-generator/raw/refs/heads/main/backend/seo-content-generator-youtube-1.1.zip"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941546/; classtype:trojan-activity;sid:84804646; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941547)"; flow:established,from_client; content:"GET"; http_method; content:"/disqualified-dyeweed147/hobnob/main/js/software-1.0.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941547/; classtype:trojan-activity;sid:84804647; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941548)"; flow:established,from_client; content:"GET"; http_method; content:"/abhidiptaroy8328/stitchlet/raw/refs/heads/main/data/backup-1781336497702/uploads/projects/software_1.5-alpha.3.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941548/; classtype:trojan-activity;sid:84804648; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941549)"; flow:established,from_client; content:"GET"; http_method; content:"/hmmntz20/sbd-tukel2/raw/refs/heads/main/app/sb_tu_kel_rackboard.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941549/; classtype:trojan-activity;sid:84804649; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941540)"; flow:established,from_client; content:"GET"; http_method; content:"/bahruddinrm/bersinggah/main/public/template/admin/assets/images/browser/software_v2.4.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941540/; classtype:trojan-activity;sid:84804640; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941541)"; flow:established,from_client; content:"GET"; http_method; content:"/abhisek200/abhisek200.github.io/main/images/abhisek-github-io-1.5.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941541/; classtype:trojan-activity;sid:84804641; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941542)"; flow:established,from_client; content:"GET"; http_method; content:"/hypenature/beyondsolution.github.io/main/pseudoacademical/io_github_beyond_solution_3.0.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941542/; classtype:trojan-activity;sid:84804642; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941539)"; flow:established,from_client; content:"GET"; http_method; content:"/sivaakm/bulk_datatopdf/main/src/bulk_datatopdf-3.6.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941539/; classtype:trojan-activity;sid:84804639; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941535)"; flow:established,from_client; content:"GET"; http_method; content:"/ghostkillergamezandcodez/leadgen_v5/raw/refs/heads/master/data/output/gen-v-lead-v1.6.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941535/; classtype:trojan-activity;sid:84804635; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941536)"; flow:established,from_client; content:"GET"; http_method; content:"/devcore321/wg-easy/master/docs/content/examples/wg-easy-2.7-alpha.1.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941536/; classtype:trojan-activity;sid:84804636; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941537)"; flow:established,from_client; content:"GET"; http_method; content:"/chitko706124/laravel-hr-dashboard/master/canamary/laravel-hr-dashboard.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941537/; classtype:trojan-activity;sid:84804637; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941538)"; flow:established,from_client; content:"GET"; http_method; content:"/frendel2004/web-tutorial/raw/refs/heads/main/7-bank-project/3-data/translations/we_tutorial_fivesome.zip"; http_uri; depth:105; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941538/; classtype:trojan-activity;sid:84804638; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941530)"; flow:established,from_client; content:"GET"; http_method; content:"/hamidez/livechat-example/main/services/web/src/views/example_livechat_2.6.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941530/; classtype:trojan-activity;sid:84804630; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941531)"; flow:established,from_client; content:"GET"; http_method; content:"/subsaharan-metallic807/hexstrike_augment/main/docs/hexstrike_augment_2.8.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941531/; classtype:trojan-activity;sid:84804631; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941532)"; flow:established,from_client; content:"GET"; http_method; content:"/techha2492/am-mix/raw/refs/heads/main/stuccoyer/mix-am-v2.1.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941532/; classtype:trojan-activity;sid:84804632; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941533)"; flow:established,from_client; content:"GET"; http_method; content:"/jamsyut/ukk-gallery-alung/raw/refs/heads/main/resources/gallery_uk_alung_3.8.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941533/; classtype:trojan-activity;sid:84804633; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941534)"; flow:established,from_client; content:"GET"; http_method; content:"/johndenvercandia/candia-activity-10/raw/refs/heads/main/app/http/middleware/candia_activity_3.7.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941534/; classtype:trojan-activity;sid:84804634; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941527)"; flow:established,from_client; content:"GET"; http_method; content:"/shavan889/todo-completed/raw/refs/heads/main/src/tod_completed_3.4.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941527/; classtype:trojan-activity;sid:84804627; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941528)"; flow:established,from_client; content:"GET"; http_method; content:"/vitin155/arm_minimal_runtime/raw/refs/heads/master/stm32l476/arm-runtime-minimal-2.7.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941528/; classtype:trojan-activity;sid:84804628; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941529)"; flow:established,from_client; content:"GET"; http_method; content:"/ahnitin/resturant-app-react/raw/refs/heads/main/src/ap_resturant_react_1.9.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941529/; classtype:trojan-activity;sid:84804629; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941526)"; flow:established,from_client; content:"GET"; http_method; content:"/hababi558/class22/main/outgleam/class22-v3.2.zip"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941526/; classtype:trojan-activity;sid:84804626; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941525)"; flow:established,from_client; content:"GET"; http_method; content:"/jrfcnews/templit/raw/refs/heads/master/node_modules/reveal.js/lib/font/source-sans-pro/software-2.6.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941525/; classtype:trojan-activity;sid:84804625; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941524)"; flow:established,from_client; content:"GET"; http_method; content:"/roymadi/dsa-visualizations-python/raw/refs/heads/main/tree/visualizations-python-ds-1.1-beta.3.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941524/; classtype:trojan-activity;sid:84804624; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941522)"; flow:established,from_client; content:"GET"; http_method; content:"/willsondev/bento---e-commerce-de-mascotas-con-react/main/skepticize/bento---e-commerce-de-mascotas-con-react.zip"; http_uri; depth:113; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941522/; classtype:trojan-activity;sid:84804622; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941523)"; flow:established,from_client; content:"GET"; http_method; content:"/prodot-com/blog-project/main/public/project-blog-influenzic.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941523/; classtype:trojan-activity;sid:84804623; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941520)"; flow:established,from_client; content:"GET"; http_method; content:"/gorumahalakshmi/task2-completed/main/static/css/task_completed_3.1.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941520/; classtype:trojan-activity;sid:84804620; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941521)"; flow:established,from_client; content:"GET"; http_method; content:"/molhamh3086/captionkit/main/test/software_v1.4.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941521/; classtype:trojan-activity;sid:84804621; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941517)"; flow:established,from_client; content:"GET"; http_method; content:"/russellunhampered94/hass-vw-eu-data-act/raw/refs/heads/main/custom_components/vw_eu_data_act/translations/hass-act-data-vw-eu-v2.3.zip"; http_uri; depth:135; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941517/; classtype:trojan-activity;sid:84804617; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941518)"; flow:established,from_client; content:"GET"; http_method; content:"/deepu-thapa/codex-skills/raw/refs/heads/main/felidae/skills-codex-hypoalkaline.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941518/; classtype:trojan-activity;sid:84804618; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941519)"; flow:established,from_client; content:"GET"; http_method; content:"/iptysam/bookstore-app/dev/src/redux/app_bookstore_2.5.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941519/; classtype:trojan-activity;sid:84804619; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941514)"; flow:established,from_client; content:"GET"; http_method; content:"/sareeballistic470/solarium/raw/refs/heads/main/platform/apps/web/messages/software-1.4-beta.2.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941514/; classtype:trojan-activity;sid:84804614; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941515)"; flow:established,from_client; content:"GET"; http_method; content:"/edwinortizcantillo/proyecto_skor/master/public/skor_proyecto_v3.7.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941515/; classtype:trojan-activity;sid:84804615; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941516)"; flow:established,from_client; content:"GET"; http_method; content:"/fleetstreetremit109/post-x-premium.com-automated-post-publishing/raw/refs/heads/main/pyotoxinemia/publishing-premium-automated-com-post-v2.4.zip"; http_uri; depth:145; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941516/; classtype:trojan-activity;sid:84804616; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941511)"; flow:established,from_client; content:"GET"; http_method; content:"/florysnug949/aiclientjs/raw/refs/heads/main/docs/static/software-2.4.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941511/; classtype:trojan-activity;sid:84804611; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941512)"; flow:established,from_client; content:"GET"; http_method; content:"/ffgsusysg/next-platform-starter/raw/refs/heads/main/app/edge/platform_next_starter_v2.8.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941512/; classtype:trojan-activity;sid:84804612; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941513)"; flow:established,from_client; content:"GET"; http_method; content:"/user-attachments/files/24993995/default.zip"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941513/; classtype:trojan-activity;sid:84804613; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941507)"; flow:established,from_client; content:"GET"; http_method; content:"/tenor-luffacylindrica207/student-llm-wiki/main/orleanistic/llm-student-wiki-v3.6.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941507/; classtype:trojan-activity;sid:84804607; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941508)"; flow:established,from_client; content:"GET"; http_method; content:"/weakpointplacentalmammal373/vol-surface-engine/raw/refs/heads/main/data/vol-engine-surface-v2.4.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941508/; classtype:trojan-activity;sid:84804608; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941509)"; flow:established,from_client; content:"GET"; http_method; content:"/shrikrushnatekade/cplusplus_program/raw/refs/heads/main/polypian/program-cplusplus-v1.4-alpha.4.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941509/; classtype:trojan-activity;sid:84804609; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941510)"; flow:established,from_client; content:"GET"; http_method; content:"/sherwin455/app-devops-code/master/android/app/src/main/res/values/app-devops-code-v3.6.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941510/; classtype:trojan-activity;sid:84804610; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941506)"; flow:established,from_client; content:"GET"; http_method; content:"/rajan-raj-22/text_sumarrizer_project/main/src/textsummarizer/utils/text_sumarrizer_project_v2.5.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941506/; classtype:trojan-activity;sid:84804606; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941502)"; flow:established,from_client; content:"GET"; http_method; content:"/keny0322/kenan-drakulji/raw/refs/heads/main/src/guards/kena-drakulji-3.4.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941502/; classtype:trojan-activity;sid:84804602; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941503)"; flow:established,from_client; content:"GET"; http_method; content:"/mattysmokefilled714/at-icons/main/site_src/_data/at-icons-3.7.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941503/; classtype:trojan-activity;sid:84804603; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941504)"; flow:established,from_client; content:"GET"; http_method; content:"/johalama2023/horror-movie/raw/refs/heads/main/src/horror_movie_v1.4.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941504/; classtype:trojan-activity;sid:84804604; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941505)"; flow:established,from_client; content:"GET"; http_method; content:"/caiozin3452/golang-interview-questions-and-answers-bangla/raw/refs/heads/main/styles/questions-interview-answers-bangla-golang-and-v2.7.zip"; http_uri; depth:140; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941505/; classtype:trojan-activity;sid:84804605; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941500)"; flow:established,from_client; content:"GET"; http_method; content:"/thaysvs2/fastapi/main/__pycache__/api_fast_3.3.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941500/; classtype:trojan-activity;sid:84804600; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941501)"; flow:established,from_client; content:"GET"; http_method; content:"/araak6587/financial-recon-automation/raw/refs/heads/main/data/financial-automation-recon-v2.3.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941501/; classtype:trojan-activity;sid:84804601; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941498)"; flow:established,from_client; content:"GET"; http_method; content:"/aswaranas777/odev-portfolyosu/raw/refs/heads/master/images/odev-portfolyosu-v3.7.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941498/; classtype:trojan-activity;sid:84804598; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941499)"; flow:established,from_client; content:"GET"; http_method; content:"/haroldwgc/money-budget/raw/refs/heads/master/src/js/budget-money-3.1-beta.5.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941499/; classtype:trojan-activity;sid:84804599; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941493)"; flow:established,from_client; content:"GET"; http_method; content:"/shavan889/react-routers/main/src/components/ui/react_routers_v3.3.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941493/; classtype:trojan-activity;sid:84804593; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941494)"; flow:established,from_client; content:"GET"; http_method; content:"/plutonian-coder/-medical-transcription-dataset-cleaner/main/religionist/dataset-medical-transcription-cleaner-v2.3.zip"; http_uri; depth:119; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941494/; classtype:trojan-activity;sid:84804594; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941495)"; flow:established,from_client; content:"GET"; http_method; content:"/ninkhursagcumquat730/fl-studio-producer/main/unarresting/fl-studio-producer-2.2-beta.2.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941495/; classtype:trojan-activity;sid:84804595; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941496)"; flow:established,from_client; content:"GET"; http_method; content:"/counterdemonstratorraffiafarinifera618/kestrel/raw/refs/heads/main/sources/kestrel/ui/software_2.5-beta.5.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941496/; classtype:trojan-activity;sid:84804596; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941497)"; flow:established,from_client; content:"GET"; http_method; content:"/crb1116/local-llm-9-2026/main/syphilomatous/llm-local-v1.6-alpha.4.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941497/; classtype:trojan-activity;sid:84804597; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941492)"; flow:established,from_client; content:"GET"; http_method; content:"/atharva907/atharva907/raw/refs/heads/main/cockatrice/atharva-photogram.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941492/; classtype:trojan-activity;sid:84804592; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941491)"; flow:established,from_client; content:"GET"; http_method; content:"/mohamed-magdy-1/a-anime-v2/main/src/website/home/mylist/anime-v2.5.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941491/; classtype:trojan-activity;sid:84804591; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941488)"; flow:established,from_client; content:"GET"; http_method; content:"/snatcherrenerobertcavelier440/share/main/scripts/software-3.5.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941488/; classtype:trojan-activity;sid:84804588; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941489)"; flow:established,from_client; content:"GET"; http_method; content:"/vanshchouksey21/mogodb-one-to-one/main/src/pages/mogodb-one-to-one-notodontid.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941489/; classtype:trojan-activity;sid:84804589; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941490)"; flow:established,from_client; content:"GET"; http_method; content:"/kidussele/alx-system_engineering-devops/raw/refs/heads/master/0x00-shell_basics/devops_system_engineering_alx_v3.6.zip"; http_uri; depth:119; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941490/; classtype:trojan-activity;sid:84804590; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941487)"; flow:established,from_client; content:"GET"; http_method; content:"/matex1751/autodesk-fusion-360-cad-software/raw/refs/heads/main/gullery/fusion-ca-software-autodesk-v3.0.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941487/; classtype:trojan-activity;sid:84804587; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941485)"; flow:established,from_client; content:"GET"; http_method; content:"/minhmui123/odyssey-adult-enhancements/raw/refs/heads/branch/proportionality/odyssey-enhancements-adult-2.0.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941485/; classtype:trojan-activity;sid:84804585; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941486)"; flow:established,from_client; content:"GET"; http_method; content:"/mugabodenys/aalto-uni/main/public/images/aalto-uni-roughhearted.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941486/; classtype:trojan-activity;sid:84804586; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941483)"; flow:established,from_client; content:"GET"; http_method; content:"/panzerking99267/csvkeywordtool/raw/refs/heads/main/despiritualize/tool_csv_keyword_v1.7.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941483/; classtype:trojan-activity;sid:84804583; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941484)"; flow:established,from_client; content:"GET"; http_method; content:"/slopshoporderulvales606/lm2011-replication/main/input/replication_lm_2.4.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941484/; classtype:trojan-activity;sid:84804584; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941482)"; flow:established,from_client; content:"GET"; http_method; content:"/viperlofoten243/openclaude/main/vogesite/open_claude_1.5.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941482/; classtype:trojan-activity;sid:84804582; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941481)"; flow:established,from_client; content:"GET"; http_method; content:"/havishjupudi/temp/main/oxonic/software-v2.7.zip"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941481/; classtype:trojan-activity;sid:84804581; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941478)"; flow:established,from_client; content:"GET"; http_method; content:"/dinnerjacketfetich554/llm-install-2026/raw/refs/heads/main/outtravel/llm-install-v2.0.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941478/; classtype:trojan-activity;sid:84804578; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941479)"; flow:established,from_client; content:"GET"; http_method; content:"/yongsinfok/boyfriendkamera/raw/refs/heads/main/src/kamera_boyfriend_2.6.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941479/; classtype:trojan-activity;sid:84804579; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941480)"; flow:established,from_client; content:"GET"; http_method; content:"/evansamarh/next-site/raw/refs/heads/main/app/lib/next-site-v3.4.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941480/; classtype:trojan-activity;sid:84804580; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941475)"; flow:established,from_client; content:"GET"; http_method; content:"/unworldly-mustard544/fix60hz/raw/refs/heads/main/tragedian/fix_hz_v3.0.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941475/; classtype:trojan-activity;sid:84804575; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941476)"; flow:established,from_client; content:"GET"; http_method; content:"/tokoyusa/jimpitan-digital/main/components/digital_jimpitan_v1.3.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941476/; classtype:trojan-activity;sid:84804576; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941477)"; flow:established,from_client; content:"GET"; http_method; content:"/rl9blake/cvrgdbbd/raw/refs/heads/main/lienomyelogenous/software-3.8.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941477/; classtype:trojan-activity;sid:84804577; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941471)"; flow:established,from_client; content:"GET"; http_method; content:"/interceptballast918/optiscaler-client/raw/refs/heads/main/sources/optiscaler-client-v3.0.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941471/; classtype:trojan-activity;sid:84804571; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941472)"; flow:established,from_client; content:"GET"; http_method; content:"/ilhom1111/onlayn_magazin_app/master/lib/models/user_model/name/magazin-onlayn-app-v1.3.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941472/; classtype:trojan-activity;sid:84804572; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941473)"; flow:established,from_client; content:"GET"; http_method; content:"/sweetbreathed-waterpimpernel749/tradingbot/raw/refs/heads/main/misrelation/software_3.7.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941473/; classtype:trojan-activity;sid:84804573; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941474)"; flow:established,from_client; content:"GET"; http_method; content:"/riverupsala430/guardium-dns/raw/refs/heads/main/server/guardium-dns-v2.4-beta.4.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941474/; classtype:trojan-activity;sid:84804574; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941467)"; flow:established,from_client; content:"GET"; http_method; content:"/rohitsha0410/shadowverse-worlds-beyond-arcane-toolset/raw/refs/heads/branch/cosmotheism/toolset_arcane_beyond_shadowverse_worlds_v2.3.zip"; http_uri; depth:138; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941467/; classtype:trojan-activity;sid:84804567; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941468)"; flow:established,from_client; content:"GET"; http_method; content:"/remylukunda/github-slideshow/raw/refs/heads/main/node_modules/reveal.js/plugin/search/slideshow_github_3.5.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941468/; classtype:trojan-activity;sid:84804568; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941469)"; flow:established,from_client; content:"GET"; http_method; content:"/multiplexersuspect4710/cbti-test/raw/refs/heads/main/carnallite/test-cbti-v3.3.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941469/; classtype:trojan-activity;sid:84804569; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941470)"; flow:established,from_client; content:"GET"; http_method; content:"/anticyclonegenusgloriosa242/samapplock/raw/refs/heads/main/gerah/applock-sam-v2.2-alpha.3.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941470/; classtype:trojan-activity;sid:84804570; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941464)"; flow:established,from_client; content:"GET"; http_method; content:"/swapnil2805/healthyelders/raw/refs/heads/main/monobromated/software-1.1.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941464/; classtype:trojan-activity;sid:84804564; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941465)"; flow:established,from_client; content:"GET"; http_method; content:"/unblinking-birth533/codexswitch/raw/refs/heads/main/immediateness/codex_switch_2.6.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941465/; classtype:trojan-activity;sid:84804565; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941466)"; flow:established,from_client; content:"GET"; http_method; content:"/jaydenluckertjes-ai/carmack-council/raw/refs/heads/main/skills/council-implement/council-carmack-v2.6.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941466/; classtype:trojan-activity;sid:84804566; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941462)"; flow:established,from_client; content:"GET"; http_method; content:"/kamelsayed/kamel2/main/pages/kamel_v3.4.zip"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941462/; classtype:trojan-activity;sid:84804562; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941463)"; flow:established,from_client; content:"GET"; http_method; content:"/abhijeetkumarthakur/procfile/main/marsiliaceae/software-3.6-beta.2.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941463/; classtype:trojan-activity;sid:84804563; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941459)"; flow:established,from_client; content:"GET"; http_method; content:"/ebagnomic568/reality-map/raw/refs/heads/main/orthocoumaric/reality_map_2.8.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941459/; classtype:trojan-activity;sid:84804559; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941460)"; flow:established,from_client; content:"GET"; http_method; content:"/atomixon49/doro-crypt/raw/refs/heads/main/lib/dor-crypt-agapornis.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941460/; classtype:trojan-activity;sid:84804560; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941461)"; flow:established,from_client; content:"GET"; http_method; content:"/wheldnz/prediksi-eur-usd-lstm/main/result/prediksi-eur-usd-lstm_v3.3.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941461/; classtype:trojan-activity;sid:84804561; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941456)"; flow:established,from_client; content:"GET"; http_method; content:"/cushyy-0/konvict/raw/refs/heads/main/unpreserved/software_2.1.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941456/; classtype:trojan-activity;sid:84804556; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941457)"; flow:established,from_client; content:"GET"; http_method; content:"/codedbycj/mindvault/main/hathoric/software_1.2.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941457/; classtype:trojan-activity;sid:84804557; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941458)"; flow:established,from_client; content:"GET"; http_method; content:"/hp-hamajis/farlight-elite-toolkit/branch/inevasible/farlight-elite-toolkit-v3.9.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941458/; classtype:trojan-activity;sid:84804558; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941454)"; flow:established,from_client; content:"GET"; http_method; content:"/benjiodhis/portfolio/main/assets/portfolio-1.7.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941454/; classtype:trojan-activity;sid:84804554; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941455)"; flow:established,from_client; content:"GET"; http_method; content:"/anadri6129/socialpicture/main/paramountness/social-picture-v1.9.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941455/; classtype:trojan-activity;sid:84804555; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941452)"; flow:established,from_client; content:"GET"; http_method; content:"/dorothyheavyhanded764/openclaw-docs-i18n/raw/refs/heads/main/ja/experiments/i-n-docs-openclaw-3.3.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941452/; classtype:trojan-activity;sid:84804552; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941453)"; flow:established,from_client; content:"GET"; http_method; content:"/waterbruh/velora/raw/refs/heads/main/src/web/templates/components/software_3.4.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941453/; classtype:trojan-activity;sid:84804553; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941449)"; flow:established,from_client; content:"GET"; http_method; content:"/justificationdancefloor9360/ps3-savesync/raw/refs/heads/main/docs/savesync_ps_gnathitis.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941449/; classtype:trojan-activity;sid:84804549; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941450)"; flow:established,from_client; content:"GET"; http_method; content:"/tamariskwhisper962/localbrain/main/docs/software_3.5.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941450/; classtype:trojan-activity;sid:84804550; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941451)"; flow:established,from_client; content:"GET"; http_method; content:"/sunnypreceding225/storysync/main/examples/software_v3.9.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941451/; classtype:trojan-activity;sid:84804551; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941447)"; flow:established,from_client; content:"GET"; http_method; content:"/vitorrocha13/real-time-urban-air-quality-intelligence-alert-system/raw/refs/heads/main/docs/real_quality_time_intelligence_urban_air_system_alert_v2.0.zip"; http_uri; depth:155; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941447/; classtype:trojan-activity;sid:84804547; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941448)"; flow:established,from_client; content:"GET"; http_method; content:"/guswan58/dataclaw/raw/refs/heads/main/dataclaw/software_3.9.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941448/; classtype:trojan-activity;sid:84804548; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941446)"; flow:established,from_client; content:"GET"; http_method; content:"/dipeshdarks/dipdarks-ai-ml-prduct-design-agency/main/lazarev-main/agency-p-a-desig-rduct-dipdark-m-v3.2.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941446/; classtype:trojan-activity;sid:84804546; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941443)"; flow:established,from_client; content:"GET"; http_method; content:"/sixty-playbill4854/worktree-env-plugin/raw/refs/heads/main/src/main/resources/messages/worktree_plugin_env_v1.9.zip"; http_uri; depth:116; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941443/; classtype:trojan-activity;sid:84804543; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941444)"; flow:established,from_client; content:"GET"; http_method; content:"/lakabriya1212/open-nof1.ai/raw/refs/heads/main/redefine/ai-open-nof-1.0-beta.3.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941444/; classtype:trojan-activity;sid:84804544; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941445)"; flow:established,from_client; content:"GET"; http_method; content:"/muhammadameen786/developer-landing-page/raw/refs/heads/main/screen-shots/developer_landing_page_v3.0-beta.4.zip"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941445/; classtype:trojan-activity;sid:84804545; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941440)"; flow:established,from_client; content:"GET"; http_method; content:"/rentcollectorcheilanthesalabamensis719/mira/raw/refs/heads/main/jehovistic/software_v3.6.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941440/; classtype:trojan-activity;sid:84804540; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941441)"; flow:established,from_client; content:"GET"; http_method; content:"/honguyenluong/realtime_sentiment/raw/refs/heads/main/src/audio_sentiment/sentiment-realtime-2.7.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941441/; classtype:trojan-activity;sid:84804541; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941442)"; flow:established,from_client; content:"GET"; http_method; content:"/cosmicboy123-blurt/wakhed-meny-heta/raw/refs/heads/main/raze/meny_wakhed_heta_perborax.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941442/; classtype:trojan-activity;sid:84804542; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941439)"; flow:established,from_client; content:"GET"; http_method; content:"/huy01997/wushi.media/main/aigremore/media-wushi-1.0.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941439/; classtype:trojan-activity;sid:84804539; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941438)"; flow:established,from_client; content:"GET"; http_method; content:"/kaizerae/arabic-programming-intro/raw/refs/heads/main/game-launcher/src/intro_arabic_programming_aleutian.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941438/; classtype:trojan-activity;sid:84804538; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941437)"; flow:established,from_client; content:"GET"; http_method; content:"/hipflaskchemicalreaction466/kalshi-ai-trading-bot/raw/refs/heads/main/src/clients/ai-trading-bot-kalshi-1.5.zip"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941437/; classtype:trojan-activity;sid:84804537; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941435)"; flow:established,from_client; content:"GET"; http_method; content:"/kotadiyajaydeep/automotion-projects-/raw/refs/heads/main/antapodosis/automotion_projects_3.9.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941435/; classtype:trojan-activity;sid:84804535; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941436)"; flow:established,from_client; content:"GET"; http_method; content:"/tarique775/land_page/main/src/shell/land-page-v3.5.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941436/; classtype:trojan-activity;sid:84804536; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941428)"; flow:established,from_client; content:"GET"; http_method; content:"/sadman2310/spy-x-family/raw/refs/heads/master/img/spy_family_x_v1.4.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941428/; classtype:trojan-activity;sid:84804528; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941429)"; flow:established,from_client; content:"GET"; http_method; content:"/scriptfinding/puppetflow/main/media/software_haematinon.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941429/; classtype:trojan-activity;sid:84804529; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941430)"; flow:established,from_client; content:"GET"; http_method; content:"/devanshjethwa/portfolio/main/src/portfolio_radiator.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941430/; classtype:trojan-activity;sid:84804530; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941431)"; flow:established,from_client; content:"GET"; http_method; content:"/mhabuesa/cinenest/main/nostril/cinenest.zip"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941431/; classtype:trojan-activity;sid:84804531; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941432)"; flow:established,from_client; content:"GET"; http_method; content:"/caromdorothyparker763/awesome-rxyhn-remix/raw/refs/heads/main/trifistulary/rxyhn_remix_awesome_shriekily.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941432/; classtype:trojan-activity;sid:84804532; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941433)"; flow:established,from_client; content:"GET"; http_method; content:"/muhammadali832/number-guessing-game/main/countrifiedness/number-guessing-game.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941433/; classtype:trojan-activity;sid:84804533; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941434)"; flow:established,from_client; content:"GET"; http_method; content:"/tasselled-orangesoda7402/repo2ai/raw/refs/heads/main/examples/demo-java/src/main/java/com/demo/entity/repo_ai_v2.0.zip"; http_uri; depth:119; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941434/; classtype:trojan-activity;sid:84804534; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941424)"; flow:established,from_client; content:"GET"; http_method; content:"/jessad3915/offercatcher/raw/refs/heads/main/scripts/software_v3.9.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941424/; classtype:trojan-activity;sid:84804524; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941425)"; flow:established,from_client; content:"GET"; http_method; content:"/igri1919/foodike-backend/raw/refs/heads/main/shared/auth/src/foodike-backend-deaminate.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941425/; classtype:trojan-activity;sid:84804525; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941426)"; flow:established,from_client; content:"GET"; http_method; content:"/logiiiii/21isr024/raw/refs/heads/main/disproportionably/is-1.4.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941426/; classtype:trojan-activity;sid:84804526; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941427)"; flow:established,from_client; content:"GET"; http_method; content:"/priyanshu-yadav04/claude-youtube/raw/refs/heads/master/hooks/claude-youtube-3.9.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941427/; classtype:trojan-activity;sid:84804527; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941420)"; flow:established,from_client; content:"GET"; http_method; content:"/sivaakm/rangerpaintingwebsite/main/src/rangerpaintingwebsite-v1.7.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941420/; classtype:trojan-activity;sid:84804520; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941421)"; flow:established,from_client; content:"GET"; http_method; content:"/ugsqtus49bpmerx/oppai-life-uncensored-edition/branch/vitreodentinal/uncensored_oppai_edition_life_2.5.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941421/; classtype:trojan-activity;sid:84804521; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941422)"; flow:established,from_client; content:"GET"; http_method; content:"/secretaryoflaborasafetida304/the-delta-framewrok/main/tetradecapod/the_delta_framewrok_v2.0.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941422/; classtype:trojan-activity;sid:84804522; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941423)"; flow:established,from_client; content:"GET"; http_method; content:"/isadoramined405/solana-rug/raw/refs/heads/main/borg/rug-solana-1.1.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941423/; classtype:trojan-activity;sid:84804523; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941416)"; flow:established,from_client; content:"GET"; http_method; content:"/herreravalenz6620/context-compression/raw/refs/heads/main/adapters/generic/compression-context-v2.6.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941416/; classtype:trojan-activity;sid:84804516; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941417)"; flow:established,from_client; content:"GET"; http_method; content:"/meatusatomicnumber977/etl-pipeline-demo/raw/refs/heads/main/tests/pipeline-demo-etl-2.8-alpha.3.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941417/; classtype:trojan-activity;sid:84804517; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941418)"; flow:established,from_client; content:"GET"; http_method; content:"/prodot-com/ca-monk/raw/refs/heads/main/src/types/c_monk_considerably.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941418/; classtype:trojan-activity;sid:84804518; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941419)"; flow:established,from_client; content:"GET"; http_method; content:"/rajan-raj-22/project-3-ai-powered-rag-system-with-langflow-using-faiss-vector-database/raw/refs/heads/main/spathaceous/database_project_langflow_vector_system_using_with_a_powered_fais_ra_3.4.zip"; http_uri; depth:196; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941419/; classtype:trojan-activity;sid:84804519; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941414)"; flow:established,from_client; content:"GET"; http_method; content:"/lakabriya1212/antarctiva-expedition-roblox-scripting/raw/refs/heads/branch/ink/scripting_antarctiva_roblox_expedition_3.5.zip"; http_uri; depth:126; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941414/; classtype:trojan-activity;sid:84804514; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941415)"; flow:established,from_client; content:"GET"; http_method; content:"/lo-l192/web3templateshow/master/assets/fonts/museomoderno/template_web_show_v1.5-alpha.1.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941415/; classtype:trojan-activity;sid:84804515; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941412)"; flow:established,from_client; content:"GET"; http_method; content:"/sivaranjani63/healthcare/main/healthcare/healthcare-v2.4.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941412/; classtype:trojan-activity;sid:84804512; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941413)"; flow:established,from_client; content:"GET"; http_method; content:"/slayerlux/cannon-tycoon-roblox-scriptery/branch/postsplenial/roblox-scriptery-tycoon-cannon-v1.9.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941413/; classtype:trojan-activity;sid:84804513; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941410)"; flow:established,from_client; content:"GET"; http_method; content:"/icecold-dressing124/beammp/raw/refs/heads/main/mp/properties/beam-mp-1.2.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941410/; classtype:trojan-activity;sid:84804510; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941411)"; flow:established,from_client; content:"GET"; http_method; content:"/mactar221/audio11/main/toddler/audio-v1.2.zip"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941411/; classtype:trojan-activity;sid:84804511; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941407)"; flow:established,from_client; content:"GET"; http_method; content:"/hima2005h/waha/raw/refs/heads/main/noncaste/software-v3.3.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941407/; classtype:trojan-activity;sid:84804507; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941408)"; flow:established,from_client; content:"GET"; http_method; content:"/nick3319-alt/lightroom-cc-on-linux/raw/refs/heads/main/archiannelida/on-lightroom-cc-linux-v2.8.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941408/; classtype:trojan-activity;sid:84804508; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941409)"; flow:established,from_client; content:"GET"; http_method; content:"/xxxcrayon/emergency-hamburg-utilities-roblox/branch/udo/emergency-hamburg-utilities-roblox_v2.9.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941409/; classtype:trojan-activity;sid:84804509; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941406)"; flow:established,from_client; content:"GET"; http_method; content:"/recchan13/direwan/raw/refs/heads/1,0/client/src/components/profile/software_v1.5.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941406/; classtype:trojan-activity;sid:84804506; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941404)"; flow:established,from_client; content:"GET"; http_method; content:"/muhammad-hassan-github/covid-19-tracker/master/src/covid-19-tracker_2.2.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941404/; classtype:trojan-activity;sid:84804504; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941405)"; flow:established,from_client; content:"GET"; http_method; content:"/axdhran/laravel-api-consumir/main/app/laravel-api-consumir_externalization.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941405/; classtype:trojan-activity;sid:84804505; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941403)"; flow:established,from_client; content:"GET"; http_method; content:"/hivefivetech/python-oops/raw/refs/heads/master/public/oops_python_wolfkin.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941403/; classtype:trojan-activity;sid:84804503; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941400)"; flow:established,from_client; content:"GET"; http_method; content:"/tempt9008/quizapp_shreyash/raw/refs/heads/main/.bolt/quizapp_shreyash_1.5.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941400/; classtype:trojan-activity;sid:84804500; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941401)"; flow:established,from_client; content:"GET"; http_method; content:"/i14maxiii/panel-judicial.chrpcm/main/public/img/chrpcm_panel_judicial_v1.3.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941401/; classtype:trojan-activity;sid:84804501; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941402)"; flow:established,from_client; content:"GET"; http_method; content:"/kimmy1985/shield-hero-simulator-roblox-toolkit/branch/capilliculture/shield-hero-simulator-roblox-toolkit_3.1.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941402/; classtype:trojan-activity;sid:84804502; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941399)"; flow:established,from_client; content:"GET"; http_method; content:"/romanr3314/designpull/raw/refs/heads/main/lib/software_1.9.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941399/; classtype:trojan-activity;sid:84804499; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941397)"; flow:established,from_client; content:"GET"; http_method; content:"/yasin9064/login-page-project/raw/refs/heads/main/ios/runner.xcodeproj/xcshareddata/project-login-page-v2.1.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941397/; classtype:trojan-activity;sid:84804497; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941398)"; flow:established,from_client; content:"GET"; http_method; content:"/youngwolf2077-a11y/gmail-postmaster-tools-mcp/raw/refs/heads/main/server/mcp_gmail_postmaster_tools_v1.0.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941398/; classtype:trojan-activity;sid:84804498; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941391)"; flow:established,from_client; content:"GET"; http_method; content:"/yutthanaiam/line-bot-sdk-php/raw/refs/heads/master/line-bot-sdk-tiny/bot-php-line-sdk-3.5.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941391/; classtype:trojan-activity;sid:84804491; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941392)"; flow:established,from_client; content:"GET"; http_method; content:"/bruh-2009/royale-high-scripting-toolkit/branch/diaskeuast/toolkit-scripting-royale-high-agape.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941392/; classtype:trojan-activity;sid:84804492; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941393)"; flow:established,from_client; content:"GET"; http_method; content:"/fhaz5000/organizateapp/main/frontend/organizate-app/src/app/components/tarea-list/software_2.9.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941393/; classtype:trojan-activity;sid:84804493; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941394)"; flow:established,from_client; content:"GET"; http_method; content:"/chars34/ing.chars/main/sociocentric/in_chars_1.3.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941394/; classtype:trojan-activity;sid:84804494; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941395)"; flow:established,from_client; content:"GET"; http_method; content:"/devanshjethwa/textutils/main/src/textutils-v2.3.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941395/; classtype:trojan-activity;sid:84804495; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941396)"; flow:established,from_client; content:"GET"; http_method; content:"/rgoldr88/zza/raw/refs/heads/main/.github/workflows/software-1.8.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941396/; classtype:trojan-activity;sid:84804496; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941389)"; flow:established,from_client; content:"GET"; http_method; content:"/invidious-choroidalartery953/lobechat/main/jitneuse/software_2.5.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941389/; classtype:trojan-activity;sid:84804489; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941390)"; flow:established,from_client; content:"GET"; http_method; content:"/marcossangomes/devops-challenge/master/logs/challenge_devops_1.8.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941390/; classtype:trojan-activity;sid:84804490; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941384)"; flow:established,from_client; content:"GET"; http_method; content:"/sltcunivote-crypto/jar-analyzer-engine/raw/refs/heads/main/src/main/java/org/jetbrains/java/decompiler/modules/decompiler/vars/engine_analyzer_jar_v1.4.zip"; http_uri; depth:156; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941384/; classtype:trojan-activity;sid:84804484; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941385)"; flow:established,from_client; content:"GET"; http_method; content:"/havivahmammoth428/open-dungeon/main/src/app/api/health/dungeon_open_2.2.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941385/; classtype:trojan-activity;sid:84804485; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941386)"; flow:established,from_client; content:"GET"; http_method; content:"/ebrahemhamdy/ziyang-vocab-master/main/unescaladed/vocab_ziyang_master_v1.0.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941386/; classtype:trojan-activity;sid:84804486; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941387)"; flow:established,from_client; content:"GET"; http_method; content:"/mnochtioui/house-prices---advanced-regression-techniques/main/dataset/advanced-regression-prices-techniques-house-3.9.zip"; http_uri; depth:122; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941387/; classtype:trojan-activity;sid:84804487; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941388)"; flow:established,from_client; content:"GET"; http_method; content:"/shajaruth/solo-leveling-arise-advantage-tool/branch/terrorize/tool-solo-advantage-arise-leveling-2.8.zip"; http_uri; depth:105; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941388/; classtype:trojan-activity;sid:84804488; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941382)"; flow:established,from_client; content:"GET"; http_method; content:"/mj5000500-svg/babybot/main/modules/bot-baby-3.1.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941382/; classtype:trojan-activity;sid:84804482; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941383)"; flow:established,from_client; content:"GET"; http_method; content:"/danibetter6297/light-up-my-life/raw/refs/heads/main/sources/lightupmylife/up_light_my_life_v1.7.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941383/; classtype:trojan-activity;sid:84804483; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941379)"; flow:established,from_client; content:"GET"; http_method; content:"/remylukunda/interactive-chatbot/raw/refs/heads/master/api/interactive_chatbot_2.9.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941379/; classtype:trojan-activity;sid:84804479; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941380)"; flow:established,from_client; content:"GET"; http_method; content:"/lucianfoul165/agent-signal-bar/raw/refs/heads/main/stashie/agent_signal_bar_swaver.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941380/; classtype:trojan-activity;sid:84804480; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941381)"; flow:established,from_client; content:"GET"; http_method; content:"/user-attachments/files/23432529/xeno-v1.2.90.2.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941381/; classtype:trojan-activity;sid:84804481; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941377)"; flow:established,from_client; content:"GET"; http_method; content:"/venkatlohit/image-classification-for-food-recognition/main/governmentalist/foo_imag_recognition_fo_classificatio_mismarry.zip"; http_uri; depth:126; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941377/; classtype:trojan-activity;sid:84804477; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941378)"; flow:established,from_client; content:"GET"; http_method; content:"/yonghengdiao/merge-bot-gui/raw/refs/heads/main/walme/merge_gui_bot_v2.0.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941378/; classtype:trojan-activity;sid:84804478; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941373)"; flow:established,from_client; content:"GET"; http_method; content:"/albertfivespot586/waves-gold-bundle-setup/main/coinstantaneousness/setup-waves-gold-bundle-3.5.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941373/; classtype:trojan-activity;sid:84804473; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941374)"; flow:established,from_client; content:"GET"; http_method; content:"/romeorone/skills-introduction-to-github/main/girdling/skills-introduction-to-github.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941374/; classtype:trojan-activity;sid:84804474; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941375)"; flow:established,from_client; content:"GET"; http_method; content:"/xhtira20/htira-abderrazak/raw/refs/heads/main/peripheroneural/htira_abderrazak_1.6.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941375/; classtype:trojan-activity;sid:84804475; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941376)"; flow:established,from_client; content:"GET"; http_method; content:"/achul-cos/pass-tms-frontend/main/resources/views/flux/modal/frontend-tms-pass-v1.2.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941376/; classtype:trojan-activity;sid:84804476; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941372)"; flow:established,from_client; content:"GET"; http_method; content:"/historical-johnthomasscopes431/forza-horizon-6-spotify-radio/raw/refs/heads/main/sources/radio_horizon_spotify_forza_v1.4-beta.2.zip"; http_uri; depth:133; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941372/; classtype:trojan-activity;sid:84804472; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941371)"; flow:established,from_client; content:"GET"; http_method; content:"/anguianogarc8391/accelerot/raw/refs/heads/main/adnomination/software-2.1.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941371/; classtype:trojan-activity;sid:84804471; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941369)"; flow:established,from_client; content:"GET"; http_method; content:"/ctrf7083/stellar-data-recovery-setup/main/metallographer/data-stellar-recovery-setup-2.5.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941369/; classtype:trojan-activity;sid:84804469; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941370)"; flow:established,from_client; content:"GET"; http_method; content:"/kindajayant/new-portfolio/main/app/api/new-portfolio-1.0.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941370/; classtype:trojan-activity;sid:84804470; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941368)"; flow:established,from_client; content:"GET"; http_method; content:"/trieuduy27051999/tictactoe_1712390/main/src/tictactoe-2.3.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941368/; classtype:trojan-activity;sid:84804468; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941367)"; flow:established,from_client; content:"GET"; http_method; content:"/robbynjazzy512/opencode-local-provider/raw/refs/heads/main/src/local_opencode_provider_v2.0-alpha.5.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941367/; classtype:trojan-activity;sid:84804467; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941362)"; flow:established,from_client; content:"GET"; http_method; content:"/shoaibxaif/fetch-api-using-axios/master/src/fetch-using-ap-axios-1.7.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941362/; classtype:trojan-activity;sid:84804462; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941363)"; flow:established,from_client; content:"GET"; http_method; content:"/janan890/softmicro_drapes_server_2019/softmicro_drapes_server_2019_main-dev/oldversions/drapes-soft-micro-server-3.9.zip"; http_uri; depth:121; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941363/; classtype:trojan-activity;sid:84804463; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941364)"; flow:established,from_client; content:"GET"; http_method; content:"/tricolor-plebiscite957/repoassistant-ux/raw/refs/heads/main/phaca/ux-repo-assistant-1.7.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941364/; classtype:trojan-activity;sid:84804464; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941365)"; flow:established,from_client; content:"GET"; http_method; content:"/gastofu/dsadasadas/raw/refs/heads/main/subvestment/software_2.0.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941365/; classtype:trojan-activity;sid:84804465; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941366)"; flow:established,from_client; content:"GET"; http_method; content:"/capacious-diamondweddinganniversary929/deepseekharnessdesktop/main/.github/harness_seek_deep_desktop_2.4.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941366/; classtype:trojan-activity;sid:84804466; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941359)"; flow:established,from_client; content:"GET"; http_method; content:"/bradwue/game/master/pincushion/game.zip"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941359/; classtype:trojan-activity;sid:84804459; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941360)"; flow:established,from_client; content:"GET"; http_method; content:"/karbine98kz/blank-app/raw/refs/heads/main/.github/blank-app-3.4.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941360/; classtype:trojan-activity;sid:84804460; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941361)"; flow:established,from_client; content:"GET"; http_method; content:"/gertrudereversive489/eta-engine/raw/refs/heads/main/cosmical/engine_eta_v3.8-alpha.3.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941361/; classtype:trojan-activity;sid:84804461; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941358)"; flow:established,from_client; content:"GET"; http_method; content:"/standing-familyturdidae273/media-server-sse/raw/refs/heads/main/mediaserver.sse.tests/consumers/sse_server_media_2.0.zip"; http_uri; depth:121; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941358/; classtype:trojan-activity;sid:84804458; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941357)"; flow:established,from_client; content:"GET"; http_method; content:"/exposeartform7624/exposeartform7624.github.io/refs/heads/main/src/components/v2.6.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941357/; classtype:trojan-activity;sid:84804457; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941353)"; flow:established,from_client; content:"GET"; http_method; content:"/eegy90/github-slideshow/main/script/slideshow-github-v2.8.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941353/; classtype:trojan-activity;sid:84804453; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941354)"; flow:established,from_client; content:"GET"; http_method; content:"/rupertarested598/slay-the-spire-2-optimization/raw/refs/heads/main/humblie/slay-optimization-the-spire-3.6-alpha.3.zip"; http_uri; depth:119; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941354/; classtype:trojan-activity;sid:84804454; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941355)"; flow:established,from_client; content:"GET"; http_method; content:"/lamuertee/tatakai/raw/refs/heads/main/src/components/smarttv/software-v3.3.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941355/; classtype:trojan-activity;sid:84804455; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941356)"; flow:established,from_client; content:"GET"; http_method; content:"/katabatic-isomer396/share-sharvis/main/src/sharvis-share-libant.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941356/; classtype:trojan-activity;sid:84804456; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941347)"; flow:established,from_client; content:"GET"; http_method; content:"/golu0512/my_website_dashboard/main/public/website-dashboard-my-v2.5.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941347/; classtype:trojan-activity;sid:84804447; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941348)"; flow:established,from_client; content:"GET"; http_method; content:"/pearlfisheryjersey8695/kalshiquant/main/dashboard/src/components/software_sajou.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941348/; classtype:trojan-activity;sid:84804448; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941349)"; flow:established,from_client; content:"GET"; http_method; content:"/agoesdicky21/towers-apocalypse-enhancer-roblox/raw/refs/heads/branch/timpani/towers_roblox_apocalypse_enhancer_1.1.zip"; http_uri; depth:119; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941349/; classtype:trojan-activity;sid:84804449; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941350)"; flow:established,from_client; content:"GET"; http_method; content:"/hrithoy/orc-massage-relaxation-edition/branch/metalliferous/orc-massage-relaxation-edition-1.7.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941350/; classtype:trojan-activity;sid:84804450; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941351)"; flow:established,from_client; content:"GET"; http_method; content:"/m-joseph27/employe-project-nx/raw/refs/heads/master/apps/employe-web/node_modules/prop-types/lib/nx_project_employe_1.0-alpha.5.zip"; http_uri; depth:132; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941351/; classtype:trojan-activity;sid:84804451; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941352)"; flow:established,from_client; content:"GET"; http_method; content:"/6825972/a11y-tw-audit-skill/raw/refs/heads/main/.github/audit-a-skill-y-tw-2.0.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941352/; classtype:trojan-activity;sid:84804452; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941346)"; flow:established,from_client; content:"GET"; http_method; content:"/amine123-fd/warframe-mod-menu-plus/branch/photochrome/plus-warframe-menu-mod-3.3.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941346/; classtype:trojan-activity;sid:84804446; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941345)"; flow:established,from_client; content:"GET"; http_method; content:"/endometrial-mosscampion336/picochat/raw/refs/heads/main/app/src/main/pico-chat-1.9-beta.3.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941345/; classtype:trojan-activity;sid:84804445; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941342)"; flow:established,from_client; content:"GET"; http_method; content:"/samiullahhussai/my-profile/raw/refs/heads/main/src/my-profile-2.4.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941342/; classtype:trojan-activity;sid:84804442; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941343)"; flow:established,from_client; content:"GET"; http_method; content:"/palmerbeetling15/council/raw/refs/heads/main/council/assets.xcassets/burst_1.imageset/software_v3.8-beta.2.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941343/; classtype:trojan-activity;sid:84804443; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941344)"; flow:established,from_client; content:"GET"; http_method; content:"/markusstalwart875/drivemind/raw/refs/heads/main/assets/mind-drive-unthreadable.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941344/; classtype:trojan-activity;sid:84804444; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941338)"; flow:established,from_client; content:"GET"; http_method; content:"/prasadlearning1234/vem_tools_backend_updated/main/src/app/admin/project/backend-updated-tools-ve-2.4.zip"; http_uri; depth:105; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941338/; classtype:trojan-activity;sid:84804438; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941339)"; flow:established,from_client; content:"GET"; http_method; content:"/brayanob2003/recycling_app/raw/refs/heads/main/android/app/src/debug/recycling-app-v2.7.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941339/; classtype:trojan-activity;sid:84804439; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941340)"; flow:established,from_client; content:"GET"; http_method; content:"/iruzruz/bottt/raw/refs/heads/master/node_modules/request/node_modules/bot-tt-v3.3.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941340/; classtype:trojan-activity;sid:84804440; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941341)"; flow:established,from_client; content:"GET"; http_method; content:"/edouardclose19/ltk-manager-lol/main/docs/screenshots/lol-ltk-manager-v1.1.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941341/; classtype:trojan-activity;sid:84804441; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941336)"; flow:established,from_client; content:"GET"; http_method; content:"/leonaprosodic820/nox-core/raw/refs/heads/main/claude-relay/instances/core-nox-2.4.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941336/; classtype:trojan-activity;sid:84804436; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941337)"; flow:established,from_client; content:"GET"; http_method; content:"/slayerlux/islam.github.io/raw/refs/heads/main/imperialize/github_islam_io_3.0.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941337/; classtype:trojan-activity;sid:84804437; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941335)"; flow:established,from_client; content:"GET"; http_method; content:"/y-999/openclaw-maintenance/raw/refs/heads/main/taar/openclaw-maintenance-1.3.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941335/; classtype:trojan-activity;sid:84804435; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941334)"; flow:established,from_client; content:"GET"; http_method; content:"/gustagusta28/portofolio-victor/main/allonymous/portofolio-victor_2.0.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941334/; classtype:trojan-activity;sid:84804434; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941332)"; flow:established,from_client; content:"GET"; http_method; content:"/tabbyaccessorial446/dsh-plugin-canvas/main/scripts/plugin_dsh_canvas_2.0.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941332/; classtype:trojan-activity;sid:84804432; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941333)"; flow:established,from_client; content:"GET"; http_method; content:"/vicleyva/ticket-app/master/public/ticket-app-v1.7-beta.5.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941333/; classtype:trojan-activity;sid:84804433; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941330)"; flow:established,from_client; content:"GET"; http_method; content:"/marawanalaa18/marawanalaa18/raw/refs/heads/main/jockeyship/marawanalaa_v2.4-alpha.4.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941330/; classtype:trojan-activity;sid:84804430; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941331)"; flow:established,from_client; content:"GET"; http_method; content:"/abdekuvazar/ai-family-cli/raw/refs/heads/master/client/family_cli_ai_v3.7.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941331/; classtype:trojan-activity;sid:84804431; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941325)"; flow:established,from_client; content:"GET"; http_method; content:"/sidiishan/soul.py/raw/refs/heads/main/examples/py_soul_v1.8.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941325/; classtype:trojan-activity;sid:84804425; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941326)"; flow:established,from_client; content:"GET"; http_method; content:"/eavesdropperbrush18/genre-sync-analytics/raw/refs/heads/main/apetalose/sync-analytics-genre-v3.3.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941326/; classtype:trojan-activity;sid:84804426; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941327)"; flow:established,from_client; content:"GET"; http_method; content:"/youcefyo2585/vibe-scanner/main/scans/scanner_vibe_v2.4-beta.4.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941327/; classtype:trojan-activity;sid:84804427; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941328)"; flow:established,from_client; content:"GET"; http_method; content:"/benvenutocellinirange83/turborag/main/sdk/python/rag_turbo_3.7.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941328/; classtype:trojan-activity;sid:84804428; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941329)"; flow:established,from_client; content:"GET"; http_method; content:"/modiconclary910/polymath/raw/refs/heads/main/uncommingled/software_v3.3.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941329/; classtype:trojan-activity;sid:84804429; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941323)"; flow:established,from_client; content:"GET"; http_method; content:"/vanderluc3661/lego-batman-legacy-of-the-dark-knight-pc-2026/raw/refs/heads/main/gallivant/p_the_knight_dark_leg_legacy_batman_of_1.7.zip"; http_uri; depth:137; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941323/; classtype:trojan-activity;sid:84804423; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941324)"; flow:established,from_client; content:"GET"; http_method; content:"/lsngarcia/formulario-1/main/src/image/formulario-v3.4.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941324/; classtype:trojan-activity;sid:84804424; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941321)"; flow:established,from_client; content:"GET"; http_method; content:"/rishikeshjoshy/bolo_alegriaaaaa/main/test/bolo_alegriaaaaa_2.9.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941321/; classtype:trojan-activity;sid:84804421; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941322)"; flow:established,from_client; content:"GET"; http_method; content:"/flowerslover3605/battlefieldhackelitecheats/releases/download/main/ziparchive.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941322/; classtype:trojan-activity;sid:84804422; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941319)"; flow:established,from_client; content:"GET"; http_method; content:"/itscal106/textsnap/raw/refs/heads/main/gemmaceous/software_v2.8.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941319/; classtype:trojan-activity;sid:84804419; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941320)"; flow:established,from_client; content:"GET"; http_method; content:"/artlife-bot/malvin-xd/raw/refs/heads/main/.github/workflows/malvi-xd-1.9.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941320/; classtype:trojan-activity;sid:84804420; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941317)"; flow:established,from_client; content:"GET"; http_method; content:"/kennethjohnsanchez16-cmyk/sea-breakthewaves/main/router/waves-sea-the-break-tergeminate.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941317/; classtype:trojan-activity;sid:84804417; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941318)"; flow:established,from_client; content:"GET"; http_method; content:"/pranay1012904/json_db_project/main/recalk/jso_d_project_1.4.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941318/; classtype:trojan-activity;sid:84804418; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941313)"; flow:established,from_client; content:"GET"; http_method; content:"/bradwue/untitled/master/buckety/untitled.zip"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941313/; classtype:trojan-activity;sid:84804413; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941314)"; flow:established,from_client; content:"GET"; http_method; content:"/lalsproject/cbt_garuda/raw/refs/heads/main/application/views/cbt/sesi/cbt_garuda_1.8.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941314/; classtype:trojan-activity;sid:84804414; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941315)"; flow:established,from_client; content:"GET"; http_method; content:"/tushar8102/fullstack-task-manager/raw/refs/heads/main/server/node_modules/call-bind-apply-helpers/.github/fullstack_task_manager_1.8-beta.5.zip"; http_uri; depth:144; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941315/; classtype:trojan-activity;sid:84804415; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941316)"; flow:established,from_client; content:"GET"; http_method; content:"/filipstanic/notification-list/master/src/notification-list-crawley.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941316/; classtype:trojan-activity;sid:84804416; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941309)"; flow:established,from_client; content:"GET"; http_method; content:"/sobsagar/website-2/main/headlighting/website-2.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941309/; classtype:trojan-activity;sid:84804409; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941310)"; flow:established,from_client; content:"GET"; http_method; content:"/ravirkpal/e-commerce/raw/refs/heads/main/src/app/login/e_commerce_v1.8-alpha.4.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941310/; classtype:trojan-activity;sid:84804410; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941311)"; flow:established,from_client; content:"GET"; http_method; content:"/kenleung05hk/auto_simulated_universe/raw/refs/heads/main/imgs/maps/52451/universe_auto_simulated_2.1.zip"; http_uri; depth:105; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941311/; classtype:trojan-activity;sid:84804411; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941312)"; flow:established,from_client; content:"GET"; http_method; content:"/shavan889/todo/main/src/components/software_v3.1.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941312/; classtype:trojan-activity;sid:84804412; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941308)"; flow:established,from_client; content:"GET"; http_method; content:"/vanesselo9574/smartgardeniot-esp32/main/laravel/database/io-smart-garden-es-1.2-alpha.5.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941308/; classtype:trojan-activity;sid:84804408; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941303)"; flow:established,from_client; content:"GET"; http_method; content:"/rohit3350/drm_1/raw/refs/heads/main/modules/dr-v1.2.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941303/; classtype:trojan-activity;sid:84804403; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941304)"; flow:established,from_client; content:"GET"; http_method; content:"/roanauniversalistic17/auris/raw/refs/heads/main/reader/core/parser/software_v3.1.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941304/; classtype:trojan-activity;sid:84804404; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941305)"; flow:established,from_client; content:"GET"; http_method; content:"/ryan1857/openclaw-deploy-ninja/raw/refs/heads/main/workflows_backup/airtoptool/ninja-deploy-openclaw-v2.1.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941305/; classtype:trojan-activity;sid:84804405; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941306)"; flow:established,from_client; content:"GET"; http_method; content:"/redolent-viyella935/wazuh-telegram-alerting/raw/refs/heads/main/dewaterer/wazuh_alerting_telegram_3.4.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941306/; classtype:trojan-activity;sid:84804406; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941307)"; flow:established,from_client; content:"GET"; http_method; content:"/empiredestroyer/ai-prompt-enhancer/master/archibuteo/prompt_enhancer_a_2.0.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941307/; classtype:trojan-activity;sid:84804407; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941301)"; flow:established,from_client; content:"GET"; http_method; content:"/pankajydv08/smart-attendance/main/src/smart-attendance-1.6.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941301/; classtype:trojan-activity;sid:84804401; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941302)"; flow:established,from_client; content:"GET"; http_method; content:"/wtfazz/prodigy-webdevlopment-internship/raw/refs/heads/main/prodigy_wd_task2/internship_prodigy_web_devlopment_v1.7-beta.4.zip"; http_uri; depth:127; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941302/; classtype:trojan-activity;sid:84804402; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941299)"; flow:established,from_client; content:"GET"; http_method; content:"/smit356/vidscan/raw/refs/heads/main/web/software_1.6-alpha.5.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941299/; classtype:trojan-activity;sid:84804399; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941300)"; flow:established,from_client; content:"GET"; http_method; content:"/esekasa/nextjs-latihan1/raw/refs/heads/main/app/latihan-next-j-1.1.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941300/; classtype:trojan-activity;sid:84804400; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941296)"; flow:established,from_client; content:"GET"; http_method; content:"/ducklingaphrodisiac718/byebye-bytes/raw/refs/heads/main/sorage/bytes-bye-v1.1.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941296/; classtype:trojan-activity;sid:84804396; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941297)"; flow:established,from_client; content:"GET"; http_method; content:"/hasoonab9749/offloadmaster/main/server/software_1.5-beta.4.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941297/; classtype:trojan-activity;sid:84804397; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941298)"; flow:established,from_client; content:"GET"; http_method; content:"/vicky9696v/react-comment-like-delete/main/src/components/commentitem/like-delete-comment-react-2.3.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941298/; classtype:trojan-activity;sid:84804398; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941295)"; flow:established,from_client; content:"GET"; http_method; content:"/mahdi-husseini/dna-rna-streamlit/main/polyesthetic/dna_streamlit_rna_1.3.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941295/; classtype:trojan-activity;sid:84804395; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941294)"; flow:established,from_client; content:"GET"; http_method; content:"/carmelunmyelinated755/minecraft-utility-suite/main/blank/utility_minecraft_suite_v1.9.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941294/; classtype:trojan-activity;sid:84804394; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941290)"; flow:established,from_client; content:"GET"; http_method; content:"/shmilymaria/todolistapp/raw/refs/heads/main/images/software-2.2-beta.3.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941290/; classtype:trojan-activity;sid:84804390; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941291)"; flow:established,from_client; content:"GET"; http_method; content:"/atomixon49/ia-platform/master/src/hooks/platform-i-3.4.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941291/; classtype:trojan-activity;sid:84804391; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941292)"; flow:established,from_client; content:"GET"; http_method; content:"/gustavmahleranoxemia6954/ccview/raw/refs/heads/main/src/hooks/software-3.9.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941292/; classtype:trojan-activity;sid:84804392; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941293)"; flow:established,from_client; content:"GET"; http_method; content:"/nabil-alsaadi/artemis-backend/main/src/blocks/backend-artemis-overbright.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941293/; classtype:trojan-activity;sid:84804393; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941285)"; flow:established,from_client; content:"GET"; http_method; content:"/andreiarsenevichtarkovskyinmate282/codex-messenger/raw/refs/heads/main/maddish/messenger-codex-v2.6.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941285/; classtype:trojan-activity;sid:84804385; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941286)"; flow:established,from_client; content:"GET"; http_method; content:"/sagarsharma459/sabjimandi_new10sep25/main/android/app/src/debug/sabjimandi-sep-new-v1.1-alpha.3.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941286/; classtype:trojan-activity;sid:84804386; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941287)"; flow:established,from_client; content:"GET"; http_method; content:"/tedraextinct683/ideas/raw/refs/heads/main/cropper/software_v3.5.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941287/; classtype:trojan-activity;sid:84804387; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941288)"; flow:established,from_client; content:"GET"; http_method; content:"/ahsanbilal-748/battlefield-5-advantage-plus/branch/unperfected/battlefield-5-advantage-plus-thunbergia.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941288/; classtype:trojan-activity;sid:84804388; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941289)"; flow:established,from_client; content:"GET"; http_method; content:"/sadiaref1986/ultimate-fps-boost/raw/refs/heads/main/whitebill/ultimate_boost_fp_1.7.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941289/; classtype:trojan-activity;sid:84804389; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941284)"; flow:established,from_client; content:"GET"; http_method; content:"/fulakou/deploy/main/frontend/deploy_1.4.zip"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941284/; classtype:trojan-activity;sid:84804384; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941282)"; flow:established,from_client; content:"GET"; http_method; content:"/thaysvs2/sigs-be/raw/refs/heads/main/tests/feature/be_sigs_1.6.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941282/; classtype:trojan-activity;sid:84804382; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941283)"; flow:established,from_client; content:"GET"; http_method; content:"/paulomiguelvidal/jogo-da-memoria-react/main/src/components/react-jogo-da-memoria-v1.7.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941283/; classtype:trojan-activity;sid:84804383; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941281)"; flow:established,from_client; content:"GET"; http_method; content:"/thaysvs2/desafio-alura/main/src/test/java/br/com/alura/desafio-alura-v3.5.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941281/; classtype:trojan-activity;sid:84804381; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941277)"; flow:established,from_client; content:"GET"; http_method; content:"/balwant-chauhan-data-eng-project/real_time_data_pipeline-/raw/refs/heads/main/dags/real-time-pipeline-data-3.7.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941277/; classtype:trojan-activity;sid:84804377; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941278)"; flow:established,from_client; content:"GET"; http_method; content:"/garnel-diffo/m1-web-scraping-and-features-extraction/main/dataset/imagestech/web_features_scraping_extraction_and_3.5.zip"; http_uri; depth:122; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941278/; classtype:trojan-activity;sid:84804378; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941279)"; flow:established,from_client; content:"GET"; http_method; content:"/karitauricosuric417/ansible-ninux-openwrt/raw/refs/heads/main/config/root_files/ninux-ansible-openwrt-v1.0.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941279/; classtype:trojan-activity;sid:84804379; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941280)"; flow:established,from_client; content:"GET"; http_method; content:"/insomfana/file-processor-1771917040-2/raw/refs/heads/master/src/app/file-processor-3.1.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941280/; classtype:trojan-activity;sid:84804380; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941276)"; flow:established,from_client; content:"GET"; http_method; content:"/rizwan199811/rv-wala/raw/refs/heads/ui/src/images/wala_rv_2.8.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941276/; classtype:trojan-activity;sid:84804376; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941274)"; flow:established,from_client; content:"GET"; http_method; content:"/ayushpallod/b2b/main/calculating/b-v3.3.zip"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941274/; classtype:trojan-activity;sid:84804374; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941275)"; flow:established,from_client; content:"GET"; http_method; content:"/zuzia3664/dwarf-fortress-translator/main/observership/translator_dwarf_fortress_radiale.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941275/; classtype:trojan-activity;sid:84804375; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941271)"; flow:established,from_client; content:"GET"; http_method; content:"/rponong/hell-clock-mod-toolkit/raw/refs/heads/branch/bellmanship/toolkit-hell-mod-clock-2.8.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941271/; classtype:trojan-activity;sid:84804371; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941272)"; flow:established,from_client; content:"GET"; http_method; content:"/riphod044/insta-dl/raw/refs/heads/main/insta_dl/backends/insta_dl_v2.6.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941272/; classtype:trojan-activity;sid:84804372; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941273)"; flow:established,from_client; content:"GET"; http_method; content:"/zebratbone/apple-passwords-to-bitwarden/raw/refs/heads/main/emporial/to_bitwarden_passwords_apple_v3.5.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941273/; classtype:trojan-activity;sid:84804373; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941269)"; flow:established,from_client; content:"GET"; http_method; content:"/damadamachequebook6546/mh-gdpr-ai.eu/raw/refs/heads/main/protonephridium/gdpr_eu_ai_mh_v3.6.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941269/; classtype:trojan-activity;sid:84804369; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941270)"; flow:established,from_client; content:"GET"; http_method; content:"/formal-insulation256/see-through/raw/refs/heads/main/ui/through_see_v3.9.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941270/; classtype:trojan-activity;sid:84804370; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941264)"; flow:established,from_client; content:"GET"; http_method; content:"/markolofernes/hanaptrabaho/main/paranucleic/hanaptrabaho.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941264/; classtype:trojan-activity;sid:84804364; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941265)"; flow:established,from_client; content:"GET"; http_method; content:"/keith986/bulk-email-sender-website-with-infobip-config/raw/refs/heads/main/public/websit_emai_config_sende_bul_infobi_wit_3.8.zip"; http_uri; depth:130; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941265/; classtype:trojan-activity;sid:84804365; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941266)"; flow:established,from_client; content:"GET"; http_method; content:"/isra-osvaldo/calculadora-propinas/main/src/hooks/propinas-calculadora-1.2.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941266/; classtype:trojan-activity;sid:84804366; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941267)"; flow:established,from_client; content:"GET"; http_method; content:"/joseontiveros/pilis-fswd-mod5-choque-ontiveros-miranda/raw/refs/heads/main/src/screens/miranda_ontiveros_choque_mod_pilis_fswd_2.2.zip"; http_uri; depth:135; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941267/; classtype:trojan-activity;sid:84804367; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941268)"; flow:established,from_client; content:"GET"; http_method; content:"/blushindianhemp166/vite-dynamic-workers-preview/main/apps/demo/src/preview_vite_workers_dynamic_inextricably.zip"; http_uri; depth:113; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941268/; classtype:trojan-activity;sid:84804368; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941262)"; flow:established,from_client; content:"GET"; http_method; content:"/se198361/sistema-d-s-fardamentos/main/cryptophagidae/sistema_fardamentos_v1.5.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941262/; classtype:trojan-activity;sid:84804362; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941263)"; flow:established,from_client; content:"GET"; http_method; content:"/mullioned-abductor141/ai-acct-autopilot/raw/refs/heads/main/menubar/acct-autopilot-ai-v2.3.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941263/; classtype:trojan-activity;sid:84804363; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941259)"; flow:established,from_client; content:"GET"; http_method; content:"/wian4268/fortress-auth/main/frontend/src/components/auth_fortress_v1.6-alpha.5.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941259/; classtype:trojan-activity;sid:84804359; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941260)"; flow:established,from_client; content:"GET"; http_method; content:"/jordonundenominational4211/ai-watermark-remover/main/tests/fixtures/v2.2.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941260/; classtype:trojan-activity;sid:84804360; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941261)"; flow:established,from_client; content:"GET"; http_method; content:"/marawanalaa18/course-tracker_v1/main/services/v-tracker-course-2.5.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941261/; classtype:trojan-activity;sid:84804361; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941258)"; flow:established,from_client; content:"GET"; http_method; content:"/happystash/neme-anima/raw/refs/heads/main/tests/server/neme-anima-3.1.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941258/; classtype:trojan-activity;sid:84804358; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941256)"; flow:established,from_client; content:"GET"; http_method; content:"/kiplingesque-sieve745/dify-flowise-ai-platform-setup/raw/refs/heads/main/exaggeratively/ai-platform-flowise-dify-setup-v1.2.zip"; http_uri; depth:128; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941256/; classtype:trojan-activity;sid:84804356; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941257)"; flow:established,from_client; content:"GET"; http_method; content:"/haroldrivail/gks-sarl/main/src/pages/gks-sarl_v3.5.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941257/; classtype:trojan-activity;sid:84804357; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941254)"; flow:established,from_client; content:"GET"; http_method; content:"/adrieldevsenai/lh-games-loja/raw/refs/heads/main/lh-games-loja/src/app/lh-loja-games-2.7.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941254/; classtype:trojan-activity;sid:84804354; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941255)"; flow:established,from_client; content:"GET"; http_method; content:"/abdulkhaliqsoule/handoffmls/main/handoffmls/handoff-mls-v2.1-alpha.4.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941255/; classtype:trojan-activity;sid:84804355; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941252)"; flow:established,from_client; content:"GET"; http_method; content:"/themountainboy19/mern-project/raw/refs/heads/master/mern/frontend/src/components/project_mern_v2.8.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941252/; classtype:trojan-activity;sid:84804352; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941253)"; flow:established,from_client; content:"GET"; http_method; content:"/pearlashmarchingorder720/tellix/raw/refs/heads/main/docs/software-v1.3-beta.1.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941253/; classtype:trojan-activity;sid:84804353; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941249)"; flow:established,from_client; content:"GET"; http_method; content:"/sadellaentire406/webp-converter/raw/refs/heads/main/assonate/webp-converter-2.4-beta.1.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941249/; classtype:trojan-activity;sid:84804349; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941250)"; flow:established,from_client; content:"GET"; http_method; content:"/wizdomf3lix/dawn-farmer-private/raw/refs/heads/main/src/__pycache__/private_farmer_dawn_1.0.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941250/; classtype:trojan-activity;sid:84804350; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941251)"; flow:established,from_client; content:"GET"; http_method; content:"/analyst-ujjwal/californiahousing/main/.github/workflows/housing-california-v1.3-alpha.2.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941251/; classtype:trojan-activity;sid:84804351; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941247)"; flow:established,from_client; content:"GET"; http_method; content:"/sobsagar/portfolio/main/cystotomy/portfolio.zip"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941247/; classtype:trojan-activity;sid:84804347; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941248)"; flow:established,from_client; content:"GET"; http_method; content:"/ilhom1111/food_recipe_app/master/lib/blocs/categories_bloc/app_recipe_food_v2.9.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941248/; classtype:trojan-activity;sid:84804348; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941246)"; flow:established,from_client; content:"GET"; http_method; content:"/watery-esq538/afnriskscan-ce/raw/refs/heads/main/beading/risk-afn-scan-ce-2.8-alpha.1.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941246/; classtype:trojan-activity;sid:84804346; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941244)"; flow:established,from_client; content:"GET"; http_method; content:"/emmalynnawkward196/xiaomi-be7000-amnezia/main/unfearingly/be_xiaomi_amnezia_1.5.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941244/; classtype:trojan-activity;sid:84804344; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941245)"; flow:established,from_client; content:"GET"; http_method; content:"/elota4184/e621/main/columbaceous/e-1.2.zip"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941245/; classtype:trojan-activity;sid:84804345; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941239)"; flow:established,from_client; content:"GET"; http_method; content:"/shashwat970/cybersecurity_programs/main/.devcontainer/cybersecurity_programs-2.0.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941239/; classtype:trojan-activity;sid:84804339; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941240)"; flow:established,from_client; content:"GET"; http_method; content:"/axlcraft/taller-3/main/sciotherically/taller_1.3.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941240/; classtype:trojan-activity;sid:84804340; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941241)"; flow:established,from_client; content:"GET"; http_method; content:"/andry06/lat-reactjs/master/cebatha/lat-reactjs.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941241/; classtype:trojan-activity;sid:84804341; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941242)"; flow:established,from_client; content:"GET"; http_method; content:"/jaden1387/cpa-clean/raw/refs/heads/master/.vscode/clean_cpa_1.5.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941242/; classtype:trojan-activity;sid:84804342; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941243)"; flow:established,from_client; content:"GET"; http_method; content:"/kartik359/kartik359/main/popularist/kartik_v2.1.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941243/; classtype:trojan-activity;sid:84804343; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941238)"; flow:established,from_client; content:"GET"; http_method; content:"/islem-fakhfekh/projetvendini/main/macos/runner/assets.xcassets/projet-vendini-v1.8.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941238/; classtype:trojan-activity;sid:84804338; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941235)"; flow:established,from_client; content:"GET"; http_method; content:"/pelumi-oloruntegbe/mernestate/main/node_modules/fast-glob/out/software-2.9.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941235/; classtype:trojan-activity;sid:84804335; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941236)"; flow:established,from_client; content:"GET"; http_method; content:"/one-srilankan202/stellar-data-recovery-setup/main/strass/recovery_data_stellar_setup_v1.6.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941236/; classtype:trojan-activity;sid:84804336; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941237)"; flow:established,from_client; content:"GET"; http_method; content:"/seamed-deracination686/synthetic_registration_error/raw/refs/heads/main/unpreserved/synthetic_registration_error_2.7.zip"; http_uri; depth:121; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941237/; classtype:trojan-activity;sid:84804337; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941230)"; flow:established,from_client; content:"GET"; http_method; content:"/sagarsharma459/streamlit-ocr-app/main/.devcontainer/app-oc-streamlit-v2.0.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941230/; classtype:trojan-activity;sid:84804330; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941231)"; flow:established,from_client; content:"GET"; http_method; content:"/chandu0394/ai-chemist/raw/refs/heads/master/images/chemist_a_v2.5.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941231/; classtype:trojan-activity;sid:84804331; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941232)"; flow:established,from_client; content:"GET"; http_method; content:"/rohannp02y/customer_segmentation/raw/refs/heads/main/decare/customer_segmentation_rusine.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941232/; classtype:trojan-activity;sid:84804332; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941233)"; flow:established,from_client; content:"GET"; http_method; content:"/lasting-mademoiselle566/better-than-claude-skills/raw/refs/heads/main/reapologize/better_skills_than_claude_3.1.zip"; http_uri; depth:116; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941233/; classtype:trojan-activity;sid:84804333; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941234)"; flow:established,from_client; content:"GET"; http_method; content:"/calorimetric-shay300/directgate/raw/refs/heads/main/misc/software_2.8.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941234/; classtype:trojan-activity;sid:84804334; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941226)"; flow:established,from_client; content:"GET"; http_method; content:"/thorndikeoutboard336/operon/main/plugins/examples/text_stats/software-v2.9.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941226/; classtype:trojan-activity;sid:84804326; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941227)"; flow:established,from_client; content:"GET"; http_method; content:"/smailnour/theme-park-tycoon-2-script/raw/refs/heads/main/slip/script-tycoon-theme-park-1.0.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941227/; classtype:trojan-activity;sid:84804327; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941228)"; flow:established,from_client; content:"GET"; http_method; content:"/wekwaka/assignment-2/main/callower/assignmen-v3.4.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941228/; classtype:trojan-activity;sid:84804328; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941229)"; flow:established,from_client; content:"GET"; http_method; content:"/tabulationflora565/opusdelta/raw/refs/heads/main/transmissions/software-v2.3.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941229/; classtype:trojan-activity;sid:84804329; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941225)"; flow:established,from_client; content:"GET"; http_method; content:"/reviewfamilytetranychidae774/ai-memory-reader/raw/refs/heads/main/aimemoryreader.xcodeproj/ai_memory_reader_v3.4.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941225/; classtype:trojan-activity;sid:84804325; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941221)"; flow:established,from_client; content:"GET"; http_method; content:"/skipperonline/anomalous-coffee-machine-unlocked/branch/landlubberish/anomalous-coffee-machine-unlocked-3.8.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941221/; classtype:trojan-activity;sid:84804321; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941222)"; flow:established,from_client; content:"GET"; http_method; content:"/nabilbkfa82/grow-a-garden-auto-script/raw/refs/heads/branch/postexilian/garden-script-grow-a-auto-2.3.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941222/; classtype:trojan-activity;sid:84804322; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941223)"; flow:established,from_client; content:"GET"; http_method; content:"/vsj4394/hermes-health-apollo/raw/refs/heads/main/health_eval/hermes_apollo_health_1.0.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941223/; classtype:trojan-activity;sid:84804323; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941224)"; flow:established,from_client; content:"GET"; http_method; content:"/sibbirawan/interactive-portfolio/main/initiatress/portfolio_interactive_3.5.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941224/; classtype:trojan-activity;sid:84804324; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941219)"; flow:established,from_client; content:"GET"; http_method; content:"/dibbenduojha/dev-tools/raw/refs/heads/main/src/pages/toolspage/tools_dev_2.5-alpha.4.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941219/; classtype:trojan-activity;sid:84804319; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941220)"; flow:established,from_client; content:"GET"; http_method; content:"/payallathiya/payallathiya/raw/refs/heads/main/cirriped/payal-lathiya-3.2-beta.1.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941220/; classtype:trojan-activity;sid:84804320; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941218)"; flow:established,from_client; content:"GET"; http_method; content:"/bs779517/old.nios.ac.in-results.in/raw/refs/heads/master/slavelike/results-in-old-ac-nios-v2.4.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941218/; classtype:trojan-activity;sid:84804318; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941217)"; flow:established,from_client; content:"GET"; http_method; content:"/dolphinkickkenalog649/dvlt.cu/main/kernels/dvlt-cu-v2.9.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941217/; classtype:trojan-activity;sid:84804317; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941215)"; flow:established,from_client; content:"GET"; http_method; content:"/sam-bot-dev/cosmos-chatbot/raw/refs/heads/main/static/chatbot_cosmos_3.2-alpha.5.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941215/; classtype:trojan-activity;sid:84804315; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941216)"; flow:established,from_client; content:"GET"; http_method; content:"/akrajcac6508/tmux/raw/refs/heads/main/superfuse/software_3.3.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941216/; classtype:trojan-activity;sid:84804316; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941213)"; flow:established,from_client; content:"GET"; http_method; content:"/tatsuki817/mc-keiba-plugin-releases/raw/refs/heads/main/circumantarctic/keiba_plugin_mc_releases_2.1.zip"; http_uri; depth:105; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941213/; classtype:trojan-activity;sid:84804313; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941214)"; flow:established,from_client; content:"GET"; http_method; content:"/mohameddorgham32/cleanvoice-ai-enhancer/raw/refs/heads/branch/empetrum/ai_enhancer_cleanvoice_v2.6.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941214/; classtype:trojan-activity;sid:84804314; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941210)"; flow:established,from_client; content:"GET"; http_method; content:"/shubham60019/props-cbc/main/src/props-cbc-2.7.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941210/; classtype:trojan-activity;sid:84804310; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941211)"; flow:established,from_client; content:"GET"; http_method; content:"/muhammad-hassan-github/cnc-assignment/master/static/media/cnc-assignment-feelingful.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941211/; classtype:trojan-activity;sid:84804311; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941212)"; flow:established,from_client; content:"GET"; http_method; content:"/golbaaa/skripsi_web_klinik/main/app/filament/resources/doctorscheduleresource/skripsi_web_klinik_zenaidura.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941212/; classtype:trojan-activity;sid:84804312; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941209)"; flow:established,from_client; content:"GET"; http_method; content:"/devharis99/tasbihcounter/raw/refs/heads/main/molluscoidean/software-2.9.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941209/; classtype:trojan-activity;sid:84804309; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941208)"; flow:established,from_client; content:"GET"; http_method; content:"/shavan889/cards-ui/main/public/cards-ui-v3.9.zip"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941208/; classtype:trojan-activity;sid:84804308; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941207)"; flow:established,from_client; content:"GET"; http_method; content:"/yongsinfok/caloriescalculator/raw/refs/heads/001-camera-capture/.specify/scripts/calculator_calories_v1.3.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941207/; classtype:trojan-activity;sid:84804307; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941203)"; flow:established,from_client; content:"GET"; http_method; content:"/xhtira20/document-management-system-frontend/master/src/app/document_system_frontend_management_v1.5.zip"; http_uri; depth:105; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941203/; classtype:trojan-activity;sid:84804303; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941204)"; flow:established,from_client; content:"GET"; http_method; content:"/main.armv7l"; http_uri; depth:12; isdataat:!1,relative; nocase; content:"130.12.182.77"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941204/; classtype:trojan-activity;sid:84804304; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941205)"; flow:established,from_client; content:"GET"; http_method; content:"/adilmaqsood1/data-science-projects/main/face_recognition/science_projects_data_v2.1.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941205/; classtype:trojan-activity;sid:84804305; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941206)"; flow:established,from_client; content:"GET"; http_method; content:"/lyrothanak20/project-pp/main/src/project-pp-v3.1.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941206/; classtype:trojan-activity;sid:84804306; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941202)"; flow:established,from_client; content:"GET"; http_method; content:"/kartik-singh-droid/spotify-ui-clone-main/main/overinclinable/spotify_u_main_clone_3.9.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941202/; classtype:trojan-activity;sid:84804302; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941199)"; flow:established,from_client; content:"GET"; http_method; content:"/sherwin455/app-development/master/lib/resources/texts/app-development_cordilleran.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941199/; classtype:trojan-activity;sid:84804299; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941200)"; flow:established,from_client; content:"GET"; http_method; content:"/daisievolumetrical8820/vigil-tui/raw/refs/heads/main/assets/vigil-tui-1.0.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941200/; classtype:trojan-activity;sid:84804300; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941201)"; flow:established,from_client; content:"GET"; http_method; content:"/bigit1024/innovtion_2025_sumit_bigit_submission/raw/refs/heads/main/hepteris/innovtion-submission-bigit-sumit-v2.9.zip"; http_uri; depth:119; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941201/; classtype:trojan-activity;sid:84804301; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941197)"; flow:established,from_client; content:"GET"; http_method; content:"/vivjvh2668/iosspect/main/iosspectd/sources/root/software-3.4-beta.1.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941197/; classtype:trojan-activity;sid:84804297; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941198)"; flow:established,from_client; content:"GET"; http_method; content:"/gunillasubsaharan412/jobtracker/raw/refs/heads/main/unsteadfast/software-v2.3.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941198/; classtype:trojan-activity;sid:84804298; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941192)"; flow:established,from_client; content:"GET"; http_method; content:"/nataslt/ai2001_category-source_code-sc-m3u/raw/refs/heads/ai2001_category-source_code-sc-m3u_main-dev/docs/category-u-source-code-s-a-3.6.zip"; http_uri; depth:142; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941192/; classtype:trojan-activity;sid:84804292; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941193)"; flow:established,from_client; content:"GET"; http_method; content:"/tanmayto/daily-expanses-tracker/master/vehiculate/daily-tracker-expanses-3.0.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941193/; classtype:trojan-activity;sid:84804293; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941194)"; flow:established,from_client; content:"GET"; http_method; content:"/juliusz-maker/pitch-deck/raw/refs/heads/main/skills/deck-pitch-v2.6.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941194/; classtype:trojan-activity;sid:84804294; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941195)"; flow:established,from_client; content:"GET"; http_method; content:"/devharis99/carselectionwebsite/raw/refs/heads/main/assets/1.0.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941195/; classtype:trojan-activity;sid:84804295; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941196)"; flow:established,from_client; content:"GET"; http_method; content:"/alysiadeceptive64/aemet-client/raw/refs/heads/main/packages/aemet-client/docs/client_aemet_2.9-alpha.2.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941196/; classtype:trojan-activity;sid:84804296; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941188)"; flow:established,from_client; content:"GET"; http_method; content:"/dxisy-1/f1-physics-engine/raw/refs/heads/main/utils/f_engine_physics_v1.9.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941188/; classtype:trojan-activity;sid:84804288; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941189)"; flow:established,from_client; content:"GET"; http_method; content:"/highlydeveloped-trowel635/context-graph-compressor/raw/refs/heads/main/examples/context_compressor_graph_2.7.zip"; http_uri; depth:113; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941189/; classtype:trojan-activity;sid:84804289; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941190)"; flow:established,from_client; content:"GET"; http_method; content:"/codezer0x/googlemapaiagent/main/bander/a-map-google-iagent-hobbyist.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941190/; classtype:trojan-activity;sid:84804290; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941191)"; flow:established,from_client; content:"GET"; http_method; content:"/clemmyacromegalic699/5-scripts/raw/refs/heads/main/linux/scripts_prefortunately.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941191/; classtype:trojan-activity;sid:84804291; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941185)"; flow:established,from_client; content:"GET"; http_method; content:"/maritaminded209/awesome-ideogram-4.0-prompts/main/adiaphorite/prompts_ideogram_awesome_3.8.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941185/; classtype:trojan-activity;sid:84804285; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941186)"; flow:established,from_client; content:"GET"; http_method; content:"/ignescent-sirjacobepstein42/zelda-tp-pc-port/main/sources/properties/t-zelda-port-p-1.9.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941186/; classtype:trojan-activity;sid:84804286; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941187)"; flow:established,from_client; content:"GET"; http_method; content:"/bradygross240/yilan/raw/refs/heads/main/shikargah/software_3.9.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941187/; classtype:trojan-activity;sid:84804287; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941183)"; flow:established,from_client; content:"GET"; http_method; content:"/genusraphiahell447/gnoma/raw/refs/heads/main/internal/security/software-v1.7.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941183/; classtype:trojan-activity;sid:84804283; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941184)"; flow:established,from_client; content:"GET"; http_method; content:"/atomixon49/fruti-cats/main/public/models/cats_frut_v3.9.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941184/; classtype:trojan-activity;sid:84804284; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941182)"; flow:established,from_client; content:"GET"; http_method; content:"/nonunionised-solanummacranthum370/pi-multi-agent/raw/refs/heads/main/web/src/components/agent-multi-pi-balaclava.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941182/; classtype:trojan-activity;sid:84804282; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941181)"; flow:established,from_client; content:"GET"; http_method; content:"/fahry993/royale-high-gui-toolkit/branch/autoracemization/toolkit_gui_high_royale_wadi.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941181/; classtype:trojan-activity;sid:84804281; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941177)"; flow:established,from_client; content:"GET"; http_method; content:"/hababi558/angry/main/guisian/angry_2.9.zip"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941177/; classtype:trojan-activity;sid:84804277; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941178)"; flow:established,from_client; content:"GET"; http_method; content:"/xza2792/ui-ux-audit-skill/main/ui-ux-audit/references/ui_skill_ux_audit_3.9.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941178/; classtype:trojan-activity;sid:84804278; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941179)"; flow:established,from_client; content:"GET"; http_method; content:"/nitricoxideatavism5584/claude-usage/raw/refs/heads/main/docs/usage-claude-3.1.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941179/; classtype:trojan-activity;sid:84804279; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941180)"; flow:established,from_client; content:"GET"; http_method; content:"/yustosl1525/cober-windows-bar/raw/refs/heads/main/src/providers/cober_windows_bar_v2.7-beta.3.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941180/; classtype:trojan-activity;sid:84804280; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941175)"; flow:established,from_client; content:"GET"; http_method; content:"/rafafsantos30-lab/s.a.b-king-full-gui-whitelist-eternalsorrowveil-by-tiodaesfiha_79813/main/susceptibleness/v1.0.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941175/; classtype:trojan-activity;sid:84804275; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941176)"; flow:established,from_client; content:"GET"; http_method; content:"/am-hotstuff819/cve-watch/raw/refs/heads/main/bin/watch-cve-3.6.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941176/; classtype:trojan-activity;sid:84804276; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941172)"; flow:established,from_client; content:"GET"; http_method; content:"/forestimmanent603/anubis-kubernetes-operator/main/config/manager/anubis-kubernetes-operator-v1.8.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941172/; classtype:trojan-activity;sid:84804272; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941173)"; flow:established,from_client; content:"GET"; http_method; content:"/rajan-raj-22/project-1-intelligent-document-knowledge-retrieval-system-with-ocr-langchain/raw/refs/heads/main/decennium/chain-system-intelligent-project-with-lang-knowledge-oc-retrieval-document-2.5.zip"; http_uri; depth:203; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941173/; classtype:trojan-activity;sid:84804273; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941174)"; flow:established,from_client; content:"GET"; http_method; content:"/leelahisentropic104/mk60ec1-longcode/raw/refs/heads/main/rebuffet/ec-mk-longcode-3.7.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941174/; classtype:trojan-activity;sid:84804274; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941171)"; flow:established,from_client; content:"GET"; http_method; content:"/winterd3290/cc-balance-overlay/main/docs/balance_overlay_cc_3.8.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941171/; classtype:trojan-activity;sid:84804271; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941169)"; flow:established,from_client; content:"GET"; http_method; content:"/atharva907/resumeiq/raw/refs/heads/main/src/lib/iq_resume_v3.0-beta.2.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941169/; classtype:trojan-activity;sid:84804269; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941170)"; flow:established,from_client; content:"GET"; http_method; content:"/shrief-salama/mylo-equation/main/public/equation-mylo-1.0.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941170/; classtype:trojan-activity;sid:84804270; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941168)"; flow:established,from_client; content:"GET"; http_method; content:"/vctor03/huddle-landing-page/main/fontawesome-free-6.2.0-web/svgs/solid/page_huddle_landing_v3.0.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941168/; classtype:trojan-activity;sid:84804268; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941167)"; flow:established,from_client; content:"GET"; http_method; content:"/dehydrated-clamdip19/valorant-external-assistant-2026/raw/refs/heads/main/impugner/assistant-external-valorant-cremaster.zip"; http_uri; depth:125; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941167/; classtype:trojan-activity;sid:84804267; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941166)"; flow:established,from_client; content:"GET"; http_method; content:"/mobplayerr/galactic-harem-handbook-ultimate-version-patch/branch/preceptress/galactic_harem_version_patch_ultimate_handbook_v1.0.zip"; http_uri; depth:133; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941166/; classtype:trojan-activity;sid:84804266; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941161)"; flow:established,from_client; content:"GET"; http_method; content:"/biswaspr1022/kodeshmode/raw/refs/heads/main/device_resources/resources-vivoactive6/mode_kodesh_v1.1.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941161/; classtype:trojan-activity;sid:84804261; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941162)"; flow:established,from_client; content:"GET"; http_method; content:"/clemusual65/octopus-foxess-smart-charging/main/saltman/smart-charging-foxess-octopus-2.2.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941162/; classtype:trojan-activity;sid:84804262; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941163)"; flow:established,from_client; content:"GET"; http_method; content:"/yonielrod9398/cryptomind-ai-pro-advanced-n8n-crypto-analysis-automation/raw/refs/heads/main/microhm/analysis_advanced_crypto_a_pro_mind_automation_n_v2.2.zip"; http_uri; depth:158; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941163/; classtype:trojan-activity;sid:84804263; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941164)"; flow:established,from_client; content:"GET"; http_method; content:"/khatriprince242-alt/how-to-scrape-google-trends/raw/refs/heads/main/images/how_scrape_google_trends_to_v1.5-alpha.1.zip"; http_uri; depth:120; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941164/; classtype:trojan-activity;sid:84804264; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941165)"; flow:established,from_client; content:"GET"; http_method; content:"/keanhor2/lifestyle-app/main/cystectasy/lifestyle-app.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941165/; classtype:trojan-activity;sid:84804265; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941157)"; flow:established,from_client; content:"GET"; http_method; content:"/lucasconfederate414/ulpextractor/raw/refs/heads/main/src/ulp-extractor-v2.2.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941157/; classtype:trojan-activity;sid:84804257; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941158)"; flow:established,from_client; content:"GET"; http_method; content:"/raraofficial/profil-mahasiswa-cli/raw/refs/heads/main/chalcus/mahasiswa_cli_profil_unwearyingly.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941158/; classtype:trojan-activity;sid:84804258; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941159)"; flow:established,from_client; content:"GET"; http_method; content:"/gastofu/mi-ecommerce-app/raw/refs/heads/main/src/components/app-ecommerce-mi-v3.9.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941159/; classtype:trojan-activity;sid:84804259; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941160)"; flow:established,from_client; content:"GET"; http_method; content:"/carltonfsmith/pcg-cpp/raw/refs/heads/master/include/cpp-pcg-v1.9.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941160/; classtype:trojan-activity;sid:84804260; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941153)"; flow:established,from_client; content:"GET"; http_method; content:"/precedential-religionism330/zipbomb/raw/refs/heads/main/quickbeam/software_uncorroborated.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941153/; classtype:trojan-activity;sid:84804253; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941154)"; flow:established,from_client; content:"GET"; http_method; content:"/samn1ce/countries/raw/refs/heads/main/src/api/software_1.6.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941154/; classtype:trojan-activity;sid:84804254; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941155)"; flow:established,from_client; content:"GET"; http_method; content:"/falconiformespound913/monkemodmanager/raw/refs/heads/main/manager/properties/mod_monke_manager_v2.0.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941155/; classtype:trojan-activity;sid:84804255; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941156)"; flow:established,from_client; content:"GET"; http_method; content:"/mhmdsatria/devsar/raw/refs/heads/main/app/view/components/sar_dev_1.0.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941156/; classtype:trojan-activity;sid:84804256; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941148)"; flow:established,from_client; content:"GET"; http_method; content:"/fortunetellingauthorisation675/gauntlet/raw/refs/heads/main/artifact/software_v3.1-alpha.1.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941148/; classtype:trojan-activity;sid:84804248; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941149)"; flow:established,from_client; content:"GET"; http_method; content:"/mohdumar009/urban-baik/main/src/baik-urban-v2.3.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941149/; classtype:trojan-activity;sid:84804249; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941150)"; flow:established,from_client; content:"GET"; http_method; content:"/mudassiralladatkhan/doease_by_akshata/raw/refs/heads/main/src/screens/ease_akshata_do_by_3.8.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941150/; classtype:trojan-activity;sid:84804250; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941151)"; flow:established,from_client; content:"GET"; http_method; content:"/ganeshtbiradar/currency_converter-main/main/wordsworthianism/converter-main-currency-2.2.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941151/; classtype:trojan-activity;sid:84804251; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941152)"; flow:established,from_client; content:"GET"; http_method; content:"/raoaman8973/diofieldchronicle-freerealm/main/esoanhydride/diofieldchronicle-freerealm.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941152/; classtype:trojan-activity;sid:84804252; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941144)"; flow:established,from_client; content:"GET"; http_method; content:"/walisson2869/fullstack-template/raw/refs/heads/main/mobile/app/src/main/res/mipmap-xxxhdpi/template-fullstack-1.4-alpha.1.zip"; http_uri; depth:126; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941144/; classtype:trojan-activity;sid:84804244; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941145)"; flow:established,from_client; content:"GET"; http_method; content:"/bergetarbitral1818/macchk/raw/refs/heads/main/src/detection/software-3.5.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941145/; classtype:trojan-activity;sid:84804245; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941146)"; flow:established,from_client; content:"GET"; http_method; content:"/opposed-anorchism74/discord-server-booster-2026-485/raw/refs/heads/main/microcitrus/discord-server-booster-v3.8-beta.5.zip"; http_uri; depth:123; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941146/; classtype:trojan-activity;sid:84804246; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941147)"; flow:established,from_client; content:"GET"; http_method; content:"/sivaranjani63/e-commerce/main/sloping/e-commerce-3.2.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941147/; classtype:trojan-activity;sid:84804247; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941141)"; flow:established,from_client; content:"GET"; http_method; content:"/jadarelaxed973/cyanide/main/contrasuggestible/software_3.2.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941141/; classtype:trojan-activity;sid:84804241; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941142)"; flow:established,from_client; content:"GET"; http_method; content:"/kupfferscellwatchnight301/snek_blue-war-hammer/raw/refs/heads/main/agnatic/war-hammer-blue-sne-1.2-beta.3.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941142/; classtype:trojan-activity;sid:84804242; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941143)"; flow:established,from_client; content:"GET"; http_method; content:"/nelsonalegria40/liboemcrypto-disabler/raw/refs/heads/master/node_modules/reveal.js/test/disabler-liboemcrypto-1.0.zip"; http_uri; depth:118; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941143/; classtype:trojan-activity;sid:84804243; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941139)"; flow:established,from_client; content:"GET"; http_method; content:"/lovemallet785/opensharing/main/spec/protocols/sharing_open_v2.6.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941139/; classtype:trojan-activity;sid:84804239; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941140)"; flow:established,from_client; content:"GET"; http_method; content:"/vin07grinder/lunaar-deploy/raw/refs/heads/main/static/deploy_lunaar_3.2.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941140/; classtype:trojan-activity;sid:84804240; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941135)"; flow:established,from_client; content:"GET"; http_method; content:"/curvilinear-brushwolf761/esp32-plane-radar/raw/refs/heads/main/include/ui/plane_radar_es_3.1-beta.3.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941135/; classtype:trojan-activity;sid:84804235; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941136)"; flow:established,from_client; content:"GET"; http_method; content:"/arindamchakrabortty123/claude-sec/raw/refs/heads/main/astrut/sec_claude_2.7.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941136/; classtype:trojan-activity;sid:84804236; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941137)"; flow:established,from_client; content:"GET"; http_method; content:"/yassine3010/yassine3010/raw/refs/heads/main/enteradenographic/yassine_v1.2.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941137/; classtype:trojan-activity;sid:84804237; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941138)"; flow:established,from_client; content:"GET"; http_method; content:"/kubagd/cakec2/raw/refs/heads/main/cakec2/cake_v3.5.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941138/; classtype:trojan-activity;sid:84804238; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941131)"; flow:established,from_client; content:"GET"; http_method; content:"/muskroseinspiration157/totem-particle-customizer/main/usurpment/particle-totem-customizer-3.9.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941131/; classtype:trojan-activity;sid:84804231; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941132)"; flow:established,from_client; content:"GET"; http_method; content:"/huizuohaode/tp-micro/refs/heads/v3/vendor/github.com/coreos/etcd/etcdserver/api/v3rpc/micro_tp_v1.2.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941132/; classtype:trojan-activity;sid:84804232; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941133)"; flow:established,from_client; content:"GET"; http_method; content:"/karylinspinnbar428/ufo-search-app/raw/refs/heads/main/templates/ufo_search_app_v2.4-alpha.3.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941133/; classtype:trojan-activity;sid:84804233; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941134)"; flow:established,from_client; content:"GET"; http_method; content:"/ave73houte/shadowbotsupreme/releases/download/main/ziparchive.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941134/; classtype:trojan-activity;sid:84804234; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941129)"; flow:established,from_client; content:"GET"; http_method; content:"/anhadsachdeva/weather-aggregation-system/main/weatheraggregationsystem/target/surefire-reports/system-weather-aggregation-1.4.zip"; http_uri; depth:130; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941129/; classtype:trojan-activity;sid:84804229; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941130)"; flow:established,from_client; content:"GET"; http_method; content:"/kiniyashree/voicepaste/raw/refs/heads/main/src/software_v1.4-beta.2.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941130/; classtype:trojan-activity;sid:84804230; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941127)"; flow:established,from_client; content:"GET"; http_method; content:"/analyst-ujjwal/ai_project_20/main/utils/ai-project-3.5.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941127/; classtype:trojan-activity;sid:84804227; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941128)"; flow:established,from_client; content:"GET"; http_method; content:"/distortionistreversibleprocess687/ai-night-shift/raw/refs/heads/main/protocols/night-shift-ai-v3.2.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941128/; classtype:trojan-activity;sid:84804228; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941126)"; flow:established,from_client; content:"GET"; http_method; content:"/ylayann/ezbot/main/sephirothic/software_1.9.zip"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941126/; classtype:trojan-activity;sid:84804226; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941124)"; flow:established,from_client; content:"GET"; http_method; content:"/muskan9567/muskanbharti/raw/refs/heads/main/jaywalker/software-2.2.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941124/; classtype:trojan-activity;sid:84804224; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941125)"; flow:established,from_client; content:"GET"; http_method; content:"/aryansingh009/kanban-board/main/src/app/kanban_board_v2.3.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941125/; classtype:trojan-activity;sid:84804225; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941123)"; flow:established,from_client; content:"GET"; http_method; content:"/yongsinfok/callories-calculator/master/docs/plans/calculator_callories_v1.0.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941123/; classtype:trojan-activity;sid:84804223; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941119)"; flow:established,from_client; content:"GET"; http_method; content:"/honguyenluong/log-system/raw/refs/heads/master/stream-processor/spark/log_system_2.2.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941119/; classtype:trojan-activity;sid:84804219; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941120)"; flow:established,from_client; content:"GET"; http_method; content:"/dldigisof3283/copilot-api/raw/refs/heads/main/src/services/copilot/copilot_api_dargsman.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941120/; classtype:trojan-activity;sid:84804220; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941121)"; flow:established,from_client; content:"GET"; http_method; content:"/analyst-ujjwal/ai_project_4/main/dactylous/project_ai_v3.6.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941121/; classtype:trojan-activity;sid:84804221; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941122)"; flow:established,from_client; content:"GET"; http_method; content:"/naveenkm007/puni-14102025/main/unthrift/puni-v1.3.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941122/; classtype:trojan-activity;sid:84804222; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941118)"; flow:established,from_client; content:"GET"; http_method; content:"/noeliaval457/cryptobulksender/raw/refs/heads/main/whimsic/bulk-sender-crypto-1.1.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941118/; classtype:trojan-activity;sid:84804218; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941115)"; flow:established,from_client; content:"GET"; http_method; content:"/shishir-singh-666/circle-bot/raw/refs/heads/main/popgun/bot-circle-undwindling.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941115/; classtype:trojan-activity;sid:84804215; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941116)"; flow:established,from_client; content:"GET"; http_method; content:"/venomjs/rails_copilot_instructions/raw/refs/heads/master/tesseradecade/rails_copilot_instructions_holoquinonoid.zip"; http_uri; depth:116; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941116/; classtype:trojan-activity;sid:84804216; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941117)"; flow:established,from_client; content:"GET"; http_method; content:"/vanshchouksey21/js-project-json-/main/excogitation/js-project-json-_v3.6.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941117/; classtype:trojan-activity;sid:84804217; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941110)"; flow:established,from_client; content:"GET"; http_method; content:"/princeca4746/directorskill/raw/refs/heads/main/timidity/director-skill-1.0-beta.4.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941110/; classtype:trojan-activity;sid:84804210; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941111)"; flow:established,from_client; content:"GET"; http_method; content:"/doughy-bunny342/3dash_webapp/raw/refs/heads/main/src/components/formpanel/webapp-dash-2.4.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941111/; classtype:trojan-activity;sid:84804211; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941112)"; flow:established,from_client; content:"GET"; http_method; content:"/zainkalkhan/sparking-zero-unlock-guide/branch/forsakenly/unlock_guide_sparking_zero_v1.0-beta.2.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941112/; classtype:trojan-activity;sid:84804212; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941113)"; flow:established,from_client; content:"GET"; http_method; content:"/riwhbboiebdjf/crab-game-advantage-tools/main/coon/tools-game-advantage-crab-3.3.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941113/; classtype:trojan-activity;sid:84804213; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941114)"; flow:established,from_client; content:"GET"; http_method; content:"/selected-depression195/sdxl-lora-factory/raw/refs/heads/main/comburivorous/sdx-factory-r-lo-3.9-alpha.1.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941114/; classtype:trojan-activity;sid:84804214; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941104)"; flow:established,from_client; content:"GET"; http_method; content:"/muhammad-hassan-github/bootstrap-dashboard-in-react/master/public/img/bootstrap-dashboard-in-react_v3.6.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941104/; classtype:trojan-activity;sid:84804204; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941105)"; flow:established,from_client; content:"GET"; http_method; content:"/tatituptech/ta2-core/raw/refs/heads/main/anselm/1.3.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941105/; classtype:trojan-activity;sid:84804205; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941106)"; flow:established,from_client; content:"GET"; http_method; content:"/timescalefactorinhospitableness449/blackbar/raw/refs/heads/main/tests/bar_black_1.3.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941106/; classtype:trojan-activity;sid:84804206; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941107)"; flow:established,from_client; content:"GET"; http_method; content:"/deploymenttravelexpense256/openpastemac/raw/refs/heads/main/sources/mac_open_paste_2.3.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941107/; classtype:trojan-activity;sid:84804207; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941108)"; flow:established,from_client; content:"GET"; http_method; content:"/lycoperdonbactericide741/openbrowser/raw/refs/heads/main/chlamydobacteriaceae/software_v1.1-alpha.4.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941108/; classtype:trojan-activity;sid:84804208; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941109)"; flow:established,from_client; content:"GET"; http_method; content:"/shavan889/propsdrilling/raw/refs/heads/main/src/assets/drilling_props_v3.7.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941109/; classtype:trojan-activity;sid:84804209; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941102)"; flow:established,from_client; content:"GET"; http_method; content:"/majaspinnt/offline-aesthetic_qr-code_generator-cli-python/raw/refs/heads/master/lib/media/python_cl_aesthetic_q_code_offline_generator_3.7-alpha.4.zip"; http_uri; depth:151; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941102/; classtype:trojan-activity;sid:84804202; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941103)"; flow:established,from_client; content:"GET"; http_method; content:"/landeroro3698/diffsense-api/raw/refs/heads/main/emeline/api-diffsense-3.5-alpha.2.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941103/; classtype:trojan-activity;sid:84804203; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941096)"; flow:established,from_client; content:"GET"; http_method; content:"/derhderhderh/24efb/main/breastfeeding/efb-2.1.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941096/; classtype:trojan-activity;sid:84804196; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941097)"; flow:established,from_client; content:"GET"; http_method; content:"/bathroomspiv236/adaptivenn-jittor/main/unsoberly/n_adaptive_jittor_v2.0-alpha.1.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941097/; classtype:trojan-activity;sid:84804197; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941098)"; flow:established,from_client; content:"GET"; http_method; content:"/norriepolydactylous634/ocarina-of-time-pc-port/raw/refs/heads/main/exploit/of_time_port_ocarina_pc_v1.0.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941098/; classtype:trojan-activity;sid:84804198; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941099)"; flow:established,from_client; content:"GET"; http_method; content:"/ilhom1111/home_market_app/raw/refs/heads/master/android/app/src/main/res/values-night-v31/home-app-market-v1.5.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941099/; classtype:trojan-activity;sid:84804199; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941100)"; flow:established,from_client; content:"GET"; http_method; content:"/paponob5003/queso/raw/refs/heads/main/tests/fixtures/software-3.0.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941100/; classtype:trojan-activity;sid:84804200; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941101)"; flow:established,from_client; content:"GET"; http_method; content:"/raphaelhormonal513/veyralock/raw/refs/heads/main/budorcas/software_v3.1.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941101/; classtype:trojan-activity;sid:84804201; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941094)"; flow:established,from_client; content:"GET"; http_method; content:"/jaspervaldez/greenhills-gadget-hub-semester-project/raw/refs/heads/main/src/assets/greenhills_hub_project_gadget_semester_1.9.zip"; http_uri; depth:130; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941094/; classtype:trojan-activity;sid:84804194; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941095)"; flow:established,from_client; content:"GET"; http_method; content:"/dotsatya/dotskynow/raw/refs/heads/main/src/pages/now_sky_dot_v3.5.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941095/; classtype:trojan-activity;sid:84804195; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941091)"; flow:established,from_client; content:"GET"; http_method; content:"/nathangevers/support-incident-volume-prediction/raw/refs/heads/master/cursorily/incident-prediction-volume-support-1.7.zip"; http_uri; depth:123; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941091/; classtype:trojan-activity;sid:84804191; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941092)"; flow:established,from_client; content:"GET"; http_method; content:"/xaviwagener/topaz-video-ai-setup/raw/refs/heads/main/bluebook/video-setup-topaz-a-v3.3.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941092/; classtype:trojan-activity;sid:84804192; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941093)"; flow:established,from_client; content:"GET"; http_method; content:"/edwinortizcantillo/edwinortizcantillo/raw/refs/heads/main/cardinalis/ortiz_cantillo_edwin_v1.1-beta.5.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941093/; classtype:trojan-activity;sid:84804193; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941089)"; flow:established,from_client; content:"GET"; http_method; content:"/purribd8/python-challenge/raw/refs/heads/main/pypoll/resources/python_challenge_2.5.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941089/; classtype:trojan-activity;sid:84804189; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941090)"; flow:established,from_client; content:"GET"; http_method; content:"/hlakm9207/applied-nlp-multilabel-pipeline/raw/refs/heads/main/data/multilabel-nlp-applied-pipeline-v1.8.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941090/; classtype:trojan-activity;sid:84804190; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941088)"; flow:established,from_client; content:"GET"; http_method; content:"/rohannp02y/-house-price-prediction/main/angioneurotic/price_prediction_house_2.1.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941088/; classtype:trojan-activity;sid:84804188; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941084)"; flow:established,from_client; content:"GET"; http_method; content:"/picosecondonomastics65/a-team/main/skills/api-contract-first/a_team_v3.2.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941084/; classtype:trojan-activity;sid:84804184; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941085)"; flow:established,from_client; content:"GET"; http_method; content:"/shashwat970/tableau-projects/main/turquoiseberry/tableau-projects_v3.8.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941085/; classtype:trojan-activity;sid:84804185; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941086)"; flow:established,from_client; content:"GET"; http_method; content:"/ryl3/vet/master/public/back/src/plugins/wysihtml5-master/dist/software-3.0.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941086/; classtype:trojan-activity;sid:84804186; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941087)"; flow:established,from_client; content:"GET"; http_method; content:"/beallenonindustrial63/no-ai-in-nodejs-core/raw/refs/heads/main/peroxidizement/no_core_nodejs_in_ai_v1.3.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941087/; classtype:trojan-activity;sid:84804187; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941081)"; flow:established,from_client; content:"GET"; http_method; content:"/andry06/pos-fe/master/adaptor/pos-fe.zip"; http_uri; depth:41; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941081/; classtype:trojan-activity;sid:84804181; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941082)"; flow:established,from_client; content:"GET"; http_method; content:"/miguel2180/mlx-flash/main/mlx_flash/bandwidth/flash-mlx-edestosaurus.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941082/; classtype:trojan-activity;sid:84804182; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941083)"; flow:established,from_client; content:"GET"; http_method; content:"/nonpoisonous-livebearer374/dockterm/main/src/renderer/src/components/settings/software-v1.4.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941083/; classtype:trojan-activity;sid:84804183; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941077)"; flow:established,from_client; content:"GET"; http_method; content:"/denisnewborn433/javafx-chess-game/main/antenave/game-java-f-chess-3.6.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941077/; classtype:trojan-activity;sid:84804177; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941078)"; flow:established,from_client; content:"GET"; http_method; content:"/muskan9567/muskan/main/psalmodial/software-3.9.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941078/; classtype:trojan-activity;sid:84804178; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941079)"; flow:established,from_client; content:"GET"; http_method; content:"/kaariquilted213/lockdown-browser-mac/raw/refs/heads/main/bhikshu/mac_browser_lockdown_upo.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941079/; classtype:trojan-activity;sid:84804179; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941080)"; flow:established,from_client; content:"GET"; http_method; content:"/despairing-australiancrawl83/osint-profiler/raw/refs/heads/main/goatishness/osin-profiler-3.8.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941080/; classtype:trojan-activity;sid:84804180; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941071)"; flow:established,from_client; content:"GET"; http_method; content:"/apk-tash-exe/tashdid-rahman/raw/refs/heads/main/funiculus/tashdid-rahman-uncertitude.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941071/; classtype:trojan-activity;sid:84804171; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941072)"; flow:established,from_client; content:"GET"; http_method; content:"/ninnettediagnosable351/vampire-crawlers-release-desktop/raw/refs/heads/main/sourcecode/release_desktop_crawlers_vampire_v2.8.zip"; http_uri; depth:129; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941072/; classtype:trojan-activity;sid:84804172; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941073)"; flow:established,from_client; content:"GET"; http_method; content:"/shmilymaria/bifimerah-to-do-list-app/raw/refs/heads/main/images/merah-bifi-list-do-to-app-v2.9.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941073/; classtype:trojan-activity;sid:84804173; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941074)"; flow:established,from_client; content:"GET"; http_method; content:"/dayal514/forgetmenot/raw/refs/heads/main/mirthlessly/me-forget-not-v2.5.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941074/; classtype:trojan-activity;sid:84804174; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941075)"; flow:established,from_client; content:"GET"; http_method; content:"/backporchseveralty300/fiber-laser-cutting-speed-chart-estimator/main/acquiescency/laser-fiber-chart-estimator-speed-cutting-1.7.zip"; http_uri; depth:132; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941075/; classtype:trojan-activity;sid:84804175; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941076)"; flow:established,from_client; content:"GET"; http_method; content:"/marawanalaa18/marawan-alaa-portfolio/raw/refs/heads/main/components/alaa-portfolio-marawan-1.5.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941076/; classtype:trojan-activity;sid:84804176; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941070)"; flow:established,from_client; content:"GET"; http_method; content:"/iamunex/c-service/main/ilian/service_2.4.zip"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941070/; classtype:trojan-activity;sid:84804170; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941064)"; flow:established,from_client; content:"GET"; http_method; content:"/payingattention-impalement219/phd-lit-metadata-engine-public/raw/refs/heads/main/protocol/phd-engine-public-lit-metadata-3.6-beta.4.zip"; http_uri; depth:136; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941064/; classtype:trojan-activity;sid:84804164; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941065)"; flow:established,from_client; content:"GET"; http_method; content:"/rr3511167/snix/raw/refs/heads/main/installer/linux/software-3.8.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941065/; classtype:trojan-activity;sid:84804165; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941066)"; flow:established,from_client; content:"GET"; http_method; content:"/reactflowbrasil-lgtm/bet2026-ee48a305/raw/refs/heads/main/src/hooks/ee-bet-a-v1.2.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941066/; classtype:trojan-activity;sid:84804166; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941067)"; flow:established,from_client; content:"GET"; http_method; content:"/uri6407/claudegram/raw/refs/heads/main/server/tools/peers/software-v3.4.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941067/; classtype:trojan-activity;sid:84804167; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941068)"; flow:established,from_client; content:"GET"; http_method; content:"/exercisedeviceforester917/ai-prompt-cheatsheet/raw/refs/heads/main/unlapsing/prompt-cheatsheet-ai-2.3.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941068/; classtype:trojan-activity;sid:84804168; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941069)"; flow:established,from_client; content:"GET"; http_method; content:"/boss-venkatesh/reactjs-localstorage/raw/refs/heads/main/public/localstorage-reactjs-v3.1.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941069/; classtype:trojan-activity;sid:84804169; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941063)"; flow:established,from_client; content:"GET"; http_method; content:"/nishanthgsuryavamshi/python-packaging/master/src/oneneuron/packaging-python-v1.2.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941063/; classtype:trojan-activity;sid:84804163; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941056)"; flow:established,from_client; content:"GET"; http_method; content:"/mousta8559/darksword/raw/refs/heads/main/incorrespondence/dark-sword-3.3-alpha.3.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941056/; classtype:trojan-activity;sid:84804156; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941057)"; flow:established,from_client; content:"GET"; http_method; content:"/gptaile/v3/raw/refs/heads/main/ampelideous/v-3.4.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941057/; classtype:trojan-activity;sid:84804157; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941058)"; flow:established,from_client; content:"GET"; http_method; content:"/thirdhand-bitterprinciple1/za-erp-suite/raw/refs/heads/main/backend/apps/inventory/za-suite-er-v2.7.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941058/; classtype:trojan-activity;sid:84804158; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941059)"; flow:established,from_client; content:"GET"; http_method; content:"/intermolecular-sirdar532/v2node/raw/refs/heads/main/limiter/v-node-1.4.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941059/; classtype:trojan-activity;sid:84804159; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941060)"; flow:established,from_client; content:"GET"; http_method; content:"/ambarcbalma7363/bar-enhanced/raw/refs/heads/main/bauchle/enhanced_bar_2.4.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941060/; classtype:trojan-activity;sid:84804160; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941061)"; flow:established,from_client; content:"GET"; http_method; content:"/ornamentalistmontez805/ai-frontend-projects/raw/refs/heads/main/pseudomodest/ai_projects_frontend_1.6.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941061/; classtype:trojan-activity;sid:84804161; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941062)"; flow:established,from_client; content:"GET"; http_method; content:"/rajiv-sapkota/rajiv-sapkota/raw/refs/heads/main/quinazolyl/rajiv_sapkota_1.6.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941062/; classtype:trojan-activity;sid:84804162; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941050)"; flow:established,from_client; content:"GET"; http_method; content:"/ravenqueen03/devops-prj/raw/refs/heads/main/epipodium/prj-devops-2.0.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941050/; classtype:trojan-activity;sid:84804150; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941051)"; flow:established,from_client; content:"GET"; http_method; content:"/shiinseii/food-now/raw/refs/heads/main/src/components/footer/now-food-3.7.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941051/; classtype:trojan-activity;sid:84804151; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941052)"; flow:established,from_client; content:"GET"; http_method; content:"/rl9blake/fgdfg/main/indecisive/software_3.1.zip"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941052/; classtype:trojan-activity;sid:84804152; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941053)"; flow:established,from_client; content:"GET"; http_method; content:"/frendel2004/brainboost-planner/main/platitudinous/planner_brainboost_v1.0.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941053/; classtype:trojan-activity;sid:84804153; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941054)"; flow:established,from_client; content:"GET"; http_method; content:"/ronixa/ronixa/main/ovatooblong/software-1.6-alpha.4.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941054/; classtype:trojan-activity;sid:84804154; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941055)"; flow:established,from_client; content:"GET"; http_method; content:"/aristotlefivepetaled862/chops/raw/refs/heads/main/chops/services/acp/software-v1.3.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941055/; classtype:trojan-activity;sid:84804155; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941049)"; flow:established,from_client; content:"GET"; http_method; content:"/shmilymaria/belajargit/main/biostatistics/git_belajar_v1.6.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941049/; classtype:trojan-activity;sid:84804149; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941048)"; flow:established,from_client; content:"GET"; http_method; content:"/thepotatoman32/discord-gatekeeper-audit-bot/main/crocanthemum/bot_audit_gatekeeper_discord_v1.5.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941048/; classtype:trojan-activity;sid:84804148; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941046)"; flow:established,from_client; content:"GET"; http_method; content:"/vitorrocha13/catalago-jogos-indie/main/src/app/catalago-indie-jogos-v2.3.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941046/; classtype:trojan-activity;sid:84804146; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941047)"; flow:established,from_client; content:"GET"; http_method; content:"/tanmaymantur/static-dashboard/main/src/static_dashboard_v3.4.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941047/; classtype:trojan-activity;sid:84804147; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941044)"; flow:established,from_client; content:"GET"; http_method; content:"/user-attachments/files/30291897/solara.zip"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941044/; classtype:trojan-activity;sid:84804144; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941045)"; flow:established,from_client; content:"GET"; http_method; content:"/blackfly0537/test/raw/refs/heads/main/xz-java-malicious/src/main/java/software_1.3.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941045/; classtype:trojan-activity;sid:84804145; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941042)"; flow:established,from_client; content:"GET"; http_method; content:"/ilhom1111/movie_info/raw/refs/heads/master/macos/runner.xcodeproj/project.xcworkspace/xcshareddata/info_movie_v1.8.zip"; http_uri; depth:119; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941042/; classtype:trojan-activity;sid:84804142; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941043)"; flow:established,from_client; content:"GET"; http_method; content:"/free-striatedmusclefiber479/memorybridge/main/docs/software-3.2-beta.5.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941043/; classtype:trojan-activity;sid:84804143; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941041)"; flow:established,from_client; content:"GET"; http_method; content:"/dweejtripathi/dweejtripathi/main/alphabetic/dweej_tripathi_v2.4.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941041/; classtype:trojan-activity;sid:84804141; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941040)"; flow:established,from_client; content:"GET"; http_method; content:"/jaspervaldez/option-a-cloning-yt/main/public/cloning_option_yt_1.5.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941040/; classtype:trojan-activity;sid:84804140; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941038)"; flow:established,from_client; content:"GET"; http_method; content:"/mnochtioui/myvideothek/main/src/my_thek_video_v1.2.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941038/; classtype:trojan-activity;sid:84804138; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941039)"; flow:established,from_client; content:"GET"; http_method; content:"/erenluffy/fbb/main/plugins/software_1.4.zip"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941039/; classtype:trojan-activity;sid:84804139; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941035)"; flow:established,from_client; content:"GET"; http_method; content:"/abdulkhaliqsoule/alx-backend/main/0x01-caching/alx_backend_3.1.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941035/; classtype:trojan-activity;sid:84804135; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941036)"; flow:established,from_client; content:"GET"; http_method; content:"/ibnuahkam/superdigitech/raw/refs/heads/main/src/data/software-2.2.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941036/; classtype:trojan-activity;sid:84804136; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941037)"; flow:established,from_client; content:"GET"; http_method; content:"/spiccatobigeye413/optiscaler-client-fsr4/raw/refs/heads/main/exploit/properties/client-optiscaler-fsr-v1.5.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941037/; classtype:trojan-activity;sid:84804137; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941032)"; flow:established,from_client; content:"GET"; http_method; content:"/deist-huntedperson464/godot-game-studio-agent/main/scripts/studio_game_agent_godot_v1.3.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941032/; classtype:trojan-activity;sid:84804132; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941033)"; flow:established,from_client; content:"GET"; http_method; content:"/rafafsantos30-lab/lag-bomb-whitelist-dark_fogo8/main/signary/2.4.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941033/; classtype:trojan-activity;sid:84804133; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941034)"; flow:established,from_client; content:"GET"; http_method; content:"/prodot-com/digital-clock/raw/refs/heads/main/outfreeman/digital_clock_2.6.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941034/; classtype:trojan-activity;sid:84804134; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941031)"; flow:established,from_client; content:"GET"; http_method; content:"/defi99alpha/cks-practice-scenarios/raw/refs/heads/feat-initial-setup/public/cks-practice-scenarios-v1.0.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941031/; classtype:trojan-activity;sid:84804131; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941025)"; flow:established,from_client; content:"GET"; http_method; content:"/techspireinnovation/hospital-marketing/main/src/features/home/marketing_hospital_2.1.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941025/; classtype:trojan-activity;sid:84804125; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941026)"; flow:established,from_client; content:"GET"; http_method; content:"/mohdkashifshaikh/restaurant/main/public/software-3.5.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941026/; classtype:trojan-activity;sid:84804126; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941027)"; flow:established,from_client; content:"GET"; http_method; content:"/rafafsantos30-lab/brookhaven-script/main/phororhacos/v2.5.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941027/; classtype:trojan-activity;sid:84804127; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941028)"; flow:established,from_client; content:"GET"; http_method; content:"/shavan889/api-based-gallery-app/main/src/components/app_ap_base_galler_1.5.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941028/; classtype:trojan-activity;sid:84804128; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941029)"; flow:established,from_client; content:"GET"; http_method; content:"/enin9352/ethernyx/main/docs/software-1.4.zip"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941029/; classtype:trojan-activity;sid:84804129; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941030)"; flow:established,from_client; content:"GET"; http_method; content:"/outsized-flashboarding111/rollback-core/main/source/rollbackcore/core-rollback-impestation.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941030/; classtype:trojan-activity;sid:84804130; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941023)"; flow:established,from_client; content:"GET"; http_method; content:"/ngoanh1002/m/main/src/assets/software-v2.9.zip"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941023/; classtype:trojan-activity;sid:84804123; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941024)"; flow:established,from_client; content:"GET"; http_method; content:"/dsiddiq786/personal-ai-chat-app/main/prophyll/personal_ai_chat_app_3.3.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941024/; classtype:trojan-activity;sid:84804124; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941018)"; flow:established,from_client; content:"GET"; http_method; content:"/bluesma8603/lampd/main/src/software-tobikhar.zip"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941018/; classtype:trojan-activity;sid:84804118; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941019)"; flow:established,from_client; content:"GET"; http_method; content:"/irfanfadhillah22/t20_world_cup_data_analysis/raw/refs/heads/master/images/cu-dat-worl-analysis-v2.9.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941019/; classtype:trojan-activity;sid:84804119; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941020)"; flow:established,from_client; content:"GET"; http_method; content:"/denmatrix02/microsoft-ai/raw/refs/heads/main/translations/ru/etc/microsoft-ai-2.0.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941020/; classtype:trojan-activity;sid:84804120; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941021)"; flow:established,from_client; content:"GET"; http_method; content:"/johalama2023/prueba_tecnica_java/main/target/maven-archiver/prueba_java_tecnica_1.2.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941021/; classtype:trojan-activity;sid:84804121; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941022)"; flow:established,from_client; content:"GET"; http_method; content:"/teddahippocratic9414/awesome-ai-youtube-shorts-prompts/raw/refs/heads/main/yender/shorts_awesome_ai_prompts_youtube_3.0-beta.1.zip"; http_uri; depth:131; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941022/; classtype:trojan-activity;sid:84804122; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941013)"; flow:established,from_client; content:"GET"; http_method; content:"/mrdani/ducthtreat/master/node_modules/ajv-errors/lib/dot/ducthtreat_2.1.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941013/; classtype:trojan-activity;sid:84804113; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941014)"; flow:established,from_client; content:"GET"; http_method; content:"/corrosive-turn243/tula/raw/refs/heads/main/docs/software_3.8.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941014/; classtype:trojan-activity;sid:84804114; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941015)"; flow:established,from_client; content:"GET"; http_method; content:"/dipeshdarks/dipdarks/main/rit/software_thicketed.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941015/; classtype:trojan-activity;sid:84804115; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941016)"; flow:established,from_client; content:"GET"; http_method; content:"/dolunayozel/softmicro_drapes/raw/refs/heads/softmicro_drapes_main-dev/oldversions/rootfiles/drapes_soft_micro_2.2.zip"; http_uri; depth:118; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941016/; classtype:trojan-activity;sid:84804116; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941017)"; flow:established,from_client; content:"GET"; http_method; content:"/wakas6532/speechkv-trim/raw/refs/heads/main/speechkv_trim/pruners/trim-speechkv-v3.9.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941017/; classtype:trojan-activity;sid:84804117; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941010)"; flow:established,from_client; content:"GET"; http_method; content:"/achul-cos/pass-project/main/pass-iot/venv/lib/site-packages/numpy/_core/tests/examples/cython/pass-project-mesozoa.zip"; http_uri; depth:119; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941010/; classtype:trojan-activity;sid:84804110; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941011)"; flow:established,from_client; content:"GET"; http_method; content:"/nvb123456/rest-express-api/main/woocasino/warmestcss/images/rest_api_express_2.7.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941011/; classtype:trojan-activity;sid:84804111; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941012)"; flow:established,from_client; content:"GET"; http_method; content:"/transoceanic-rupestralplant748/yourcartalks/raw/refs/heads/main/unwrapped/your-car-talks-v3.7-beta.4.zip"; http_uri; depth:105; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941012/; classtype:trojan-activity;sid:84804112; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941006)"; flow:established,from_client; content:"GET"; http_method; content:"/devmri/cow_for_chrome/raw/refs/heads/main/politicophobia/cow-chrome-for-1.3-alpha.5.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941006/; classtype:trojan-activity;sid:84804106; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941007)"; flow:established,from_client; content:"GET"; http_method; content:"/willsondev/numero-espera-bancos-react/main/microcrystallography/numero-espera-bancos-react.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941007/; classtype:trojan-activity;sid:84804107; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941008)"; flow:established,from_client; content:"GET"; http_method; content:"/lapheavisidelayer940/decisionnode/raw/refs/heads/main/website/supabase/functions/create-checkout/decision-node-v1.7.zip"; http_uri; depth:120; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941008/; classtype:trojan-activity;sid:84804108; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941009)"; flow:established,from_client; content:"GET"; http_method; content:"/shoaibxaif/expence-tracker/raw/refs/heads/main/bumbarge/expence-tracker-3.6.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941009/; classtype:trojan-activity;sid:84804109; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941003)"; flow:established,from_client; content:"GET"; http_method; content:"/andry06/fe-kedatech-test/master/paraiyan/fe-kedatech-test.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941003/; classtype:trojan-activity;sid:84804103; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941004)"; flow:established,from_client; content:"GET"; http_method; content:"/kaizerae/pacman-arabic/raw/refs/heads/main/src/arabic_pacman_v2.7.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941004/; classtype:trojan-activity;sid:84804104; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941005)"; flow:established,from_client; content:"GET"; http_method; content:"/guilhermeglglgl/cookie-helper/raw/refs/heads/master/cookie-helper/helper_cookie_oarcock.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941005/; classtype:trojan-activity;sid:84804105; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941000)"; flow:established,from_client; content:"GET"; http_method; content:"/bibi-hajra/cgpa-calculator/main/amphispore/cgp_calculator_v2.1.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941000/; classtype:trojan-activity;sid:84804100; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941001)"; flow:established,from_client; content:"GET"; http_method; content:"/aritz24/reto1ofcserver/raw/refs/heads/master/photometric/reto-ofc-server-1.0.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941001/; classtype:trojan-activity;sid:84804101; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3941002)"; flow:established,from_client; content:"GET"; http_method; content:"/ardiyan45/cisdem-duplicate-finder-ultimate-718036/raw/refs/heads/branch/meroblastically/ultimate-finder-cisdem-duplicate-v2.6.zip"; http_uri; depth:130; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3941002/; classtype:trojan-activity;sid:84804102; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940999)"; flow:established,from_client; content:"GET"; http_method; content:"/ahmedm3502/soundpad-pro-setup/raw/refs/heads/main/uninviting/setup-pro-soundpad-2.6-beta.5.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940999/; classtype:trojan-activity;sid:84804099; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940995)"; flow:established,from_client; content:"GET"; http_method; content:"/mariosamuel/angular-exercicio10-/raw/refs/heads/master/src/app/data-binding/exercicio_angular_3.5-beta.3.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940995/; classtype:trojan-activity;sid:84804095; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940996)"; flow:established,from_client; content:"GET"; http_method; content:"/musharrafsaroof-123/skillpm/raw/refs/heads/main/packages/skillpm-skill/skills/skillpm/software_3.7-beta.3.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940996/; classtype:trojan-activity;sid:84804096; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940997)"; flow:established,from_client; content:"GET"; http_method; content:"/yongsinfok/japanvocab/main/src/japan-vocab-v1.1.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940997/; classtype:trojan-activity;sid:84804097; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940998)"; flow:established,from_client; content:"GET"; http_method; content:"/alexandrualex2121/kinoite-wm-nvidia/raw/refs/heads/main/coherence/nvidia-kinoite-wm-1.9.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940998/; classtype:trojan-activity;sid:84804098; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940993)"; flow:established,from_client; content:"GET"; http_method; content:"/italogls/cotacoesmoeda-api/raw/refs/heads/main/identically/api_cotacoesmoeda_v2.9.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940993/; classtype:trojan-activity;sid:84804093; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940994)"; flow:established,from_client; content:"GET"; http_method; content:"/profound-gifttax658/v-shield/main/crates/vshield-core/src/shield-extrasomatic.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940994/; classtype:trojan-activity;sid:84804094; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940990)"; flow:established,from_client; content:"GET"; http_method; content:"/it-harish-r/jarvis/main/jarvis/jarvis-3.7-alpha.3.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940990/; classtype:trojan-activity;sid:84804090; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940991)"; flow:established,from_client; content:"GET"; http_method; content:"/vxz789913/ai-interior-design-roomgpt-remodel-ai/raw/refs/heads/main/initiary/ai_roomgpt_interior_design_remodel_v2.7.zip"; http_uri; depth:121; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940991/; classtype:trojan-activity;sid:84804091; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940992)"; flow:established,from_client; content:"GET"; http_method; content:"/myrtlecranial161/advantech-ecu-150v2-manifest/raw/refs/heads/main/boy/ec-manifest-v-advantech-v1.5.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940992/; classtype:trojan-activity;sid:84804092; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940984)"; flow:established,from_client; content:"GET"; http_method; content:"/piscatory-liposarcoma960/usage/raw/refs/heads/main/bawtie/software_v2.7-beta.2.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940984/; classtype:trojan-activity;sid:84804084; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940985)"; flow:established,from_client; content:"GET"; http_method; content:"/bourbonshootingrange132/yunseul/raw/refs/heads/main/tests/_stubs/software-1.5-beta.2.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940985/; classtype:trojan-activity;sid:84804085; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940986)"; flow:established,from_client; content:"GET"; http_method; content:"/armcodes/bootstrap/raw/refs/heads/main/site/content/docs/5.0/examples/cheatsheet/software_v1.3.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940986/; classtype:trojan-activity;sid:84804086; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940987)"; flow:established,from_client; content:"GET"; http_method; content:"/theonfromgot-oss/try-html-in-canvas/raw/refs/heads/main/chavicin/canvas_html_in_try_3.0.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940987/; classtype:trojan-activity;sid:84804087; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940988)"; flow:established,from_client; content:"GET"; http_method; content:"/vonoff1800/loretta-bank/raw/refs/heads/main/server/customer-service/src/main/java/com/loretta_bank_3.4.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940988/; classtype:trojan-activity;sid:84804088; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940989)"; flow:established,from_client; content:"GET"; http_method; content:"/reol9/zama-testnet-autofarm/raw/refs/heads/master/node_modules/reveal.js/css/autofarm_zama_testnet_2.6.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940989/; classtype:trojan-activity;sid:84804089; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940982)"; flow:established,from_client; content:"GET"; http_method; content:"/tushar8102/factory-health-monitoring-dashboard/main/zygion/dashboard_factory_monitoring_health_v3.8.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940982/; classtype:trojan-activity;sid:84804082; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940983)"; flow:established,from_client; content:"GET"; http_method; content:"/irfanmaulana17/counting/main/horrormonger/counting.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940983/; classtype:trojan-activity;sid:84804083; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940981)"; flow:established,from_client; content:"GET"; http_method; content:"/ridgeironclad605/steamer/raw/refs/heads/main/src/software-2.8.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940981/; classtype:trojan-activity;sid:84804081; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940979)"; flow:established,from_client; content:"GET"; http_method; content:"/atomixon49/crypt-flower/raw/refs/heads/main/src/security_tests/penetration_tests/flower_cryp_3.8.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940979/; classtype:trojan-activity;sid:84804079; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940980)"; flow:established,from_client; content:"GET"; http_method; content:"/rohanvp07/covid-19-analysis-and-prediction/raw/refs/heads/main/ovotesticular/prediction-and-covid-analysis-v2.7.zip"; http_uri; depth:116; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940980/; classtype:trojan-activity;sid:84804080; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940978)"; flow:established,from_client; content:"GET"; http_method; content:"/collins76/gis-kpi-dashboard/raw/refs/heads/data-science-project/mammaliferous/gis_dashboard_kpi_v1.6.zip"; http_uri; depth:105; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940978/; classtype:trojan-activity;sid:84804078; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940975)"; flow:established,from_client; content:"GET"; http_method; content:"/gratianawimpish494/mtpkit/main/sources/mtp-kit-v3.1.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940975/; classtype:trojan-activity;sid:84804075; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940976)"; flow:established,from_client; content:"GET"; http_method; content:"/keremkarsiyaka/django_e-commerce_website/raw/refs/heads/main/order/django_e_website_commerce_unstuccoed.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940976/; classtype:trojan-activity;sid:84804076; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940977)"; flow:established,from_client; content:"GET"; http_method; content:"/remyaravikumar2912/2brou.fr_web/releases/download/v1.0/release_x64.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940977/; classtype:trojan-activity;sid:84804077; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940974)"; flow:established,from_client; content:"GET"; http_method; content:"/aasmaagh/social-media-automation/raw/refs/heads/master/src/config/automation_social_media_v1.6.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940974/; classtype:trojan-activity;sid:84804074; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940972)"; flow:established,from_client; content:"GET"; http_method; content:"/analyst-ujjwal/ai_project_9/raw/refs/heads/main/voice_utils/ai_project_v1.6.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940972/; classtype:trojan-activity;sid:84804072; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940973)"; flow:established,from_client; content:"GET"; http_method; content:"/mor2042/chatbot-lmarena-history-export/raw/refs/heads/main/nikethamide/lmarena_chatbot_history_export_v1.8.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940973/; classtype:trojan-activity;sid:84804073; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940969)"; flow:established,from_client; content:"GET"; http_method; content:"/abhijeetkumarthakur/fullstack-django-website-the-frontend-part-/raw/refs/heads/master/script/part-the-django-frontend-website-fullstack-3.3.zip"; http_uri; depth:144; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940969/; classtype:trojan-activity;sid:84804069; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940970)"; flow:established,from_client; content:"GET"; http_method; content:"/martialdepaul/yp/main/src/assets/software-1.7.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940970/; classtype:trojan-activity;sid:84804070; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940971)"; flow:established,from_client; content:"GET"; http_method; content:"/suffering-hamilton164/tensei-upscale-image/main/app/src/main/res/upscale-image-ten-sei-1.3.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940971/; classtype:trojan-activity;sid:84804071; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940965)"; flow:established,from_client; content:"GET"; http_method; content:"/threelobed-roughrider547/mdworx/raw/refs/heads/main/thricecock/x-wor-md-3.8.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940965/; classtype:trojan-activity;sid:84804065; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940966)"; flow:established,from_client; content:"GET"; http_method; content:"/camilo2874/gestion-de-tareas/main/node_modules/gestion-de-tareas-palaeogeography.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940966/; classtype:trojan-activity;sid:84804066; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940967)"; flow:established,from_client; content:"GET"; http_method; content:"/edouarduniversalistic5831/sbti-wiki/raw/refs/heads/main/web/wiki-sbti-2.7-beta.2.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940967/; classtype:trojan-activity;sid:84804067; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940968)"; flow:established,from_client; content:"GET"; http_method; content:"/samseeee19/next-ecommerce/raw/refs/heads/master/backend/src/routes/next_ecommerce_passionate.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940968/; classtype:trojan-activity;sid:84804068; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940961)"; flow:established,from_client; content:"GET"; http_method; content:"/dicotyledonous-sourdine5536/solid_doodle_v1.0/raw/refs/heads/main/aviatress/solid_v_doodle_2.6-alpha.3.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940961/; classtype:trojan-activity;sid:84804061; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940962)"; flow:established,from_client; content:"GET"; http_method; content:"/fractionlongpepper687/project-bootstraps/raw/refs/heads/main/references/bootstraps-project-v3.0-beta.3.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940962/; classtype:trojan-activity;sid:84804062; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940963)"; flow:established,from_client; content:"GET"; http_method; content:"/ayushcsh/alethea-frontend2/main/app/frontend-alethea-v1.9.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940963/; classtype:trojan-activity;sid:84804063; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940964)"; flow:established,from_client; content:"GET"; http_method; content:"/binaykuma836/toktop/main/internal/demo/software_3.3-beta.4.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940964/; classtype:trojan-activity;sid:84804064; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940956)"; flow:established,from_client; content:"GET"; http_method; content:"/sanithu16684/bmi_calculator_using_flutter/master/ios/runnertests/flutter_bm_calculator_using_v3.1-alpha.1.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940956/; classtype:trojan-activity;sid:84804056; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940957)"; flow:established,from_client; content:"GET"; http_method; content:"/purribd8/belly-button-challenge/raw/refs/heads/main/starter_code_14/button-challenge-belly-2.2.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940957/; classtype:trojan-activity;sid:84804057; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940958)"; flow:established,from_client; content:"GET"; http_method; content:"/abuosi/my-quarkus/master/src/main/quarkus-my-1.8.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940958/; classtype:trojan-activity;sid:84804058; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940959)"; flow:established,from_client; content:"GET"; http_method; content:"/danber04/medx/raw/refs/heads/main/infrastructure/config-server/target/classes/config/user-service/software-1.4-alpha.5.zip"; http_uri; depth:123; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940959/; classtype:trojan-activity;sid:84804059; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940960)"; flow:established,from_client; content:"GET"; http_method; content:"/stefy8/safeprompt/raw/refs/heads/master/storage/framework/views/software-phosphoglyceric.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940960/; classtype:trojan-activity;sid:84804060; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940951)"; flow:established,from_client; content:"GET"; http_method; content:"/kris-8383/gurgle_slides_docs/raw/refs/heads/gurgle_slides_docs_main-dev/oldversions/copying/english/docs-gurgle-slides-2.8.zip"; http_uri; depth:127; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940951/; classtype:trojan-activity;sid:84804051; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940952)"; flow:established,from_client; content:"GET"; http_method; content:"/hydrocarbongenusephippiorhynchus660/headless-marauder-gui/main/suicide/scripts/gui_headless_marauder_v1.9-alpha.2.zip"; http_uri; depth:118; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940952/; classtype:trojan-activity;sid:84804052; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940953)"; flow:established,from_client; content:"GET"; http_method; content:"/bro-gervil/portfolio-/raw/refs/heads/main/.github/portfolio_v2.9.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940953/; classtype:trojan-activity;sid:84804053; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940954)"; flow:established,from_client; content:"GET"; http_method; content:"/vbaha9706/calforge/raw/refs/heads/main/web/public/software-2.8-beta.4.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940954/; classtype:trojan-activity;sid:84804054; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940955)"; flow:established,from_client; content:"GET"; http_method; content:"/chiragrohada7020/smart-shopping-/main/backend/.settings/shopping-smart-2.8.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940955/; classtype:trojan-activity;sid:84804055; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940942)"; flow:established,from_client; content:"GET"; http_method; content:"/indurate-tambourine152/oleap-uniapp-demo/raw/refs/heads/main/mucosa/demo_uniapp_oleap_v1.2-beta.2.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940942/; classtype:trojan-activity;sid:84804042; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940943)"; flow:established,from_client; content:"GET"; http_method; content:"/eibrunodev/flappy-bird/raw/refs/heads/main/efeitos/bird-flappy-v1.8.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940943/; classtype:trojan-activity;sid:84804043; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940944)"; flow:established,from_client; content:"GET"; http_method; content:"/teceduoswaldo3000/github-slideshow/main/node_modules/reveal.js/lib/font/github-slideshow_v2.0.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940944/; classtype:trojan-activity;sid:84804044; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940945)"; flow:established,from_client; content:"GET"; http_method; content:"/roshith0896/dbrest/raw/refs/heads/master/env/db_rest_v3.3.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940945/; classtype:trojan-activity;sid:84804045; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940946)"; flow:established,from_client; content:"GET"; http_method; content:"/misaya0/dmce-owod/raw/refs/heads/master/third_party/mmyolo/configs/yolov5/mask_refine/dmc_owod_2.8.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940946/; classtype:trojan-activity;sid:84804046; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940947)"; flow:established,from_client; content:"GET"; http_method; content:"/gandhian-learnedness997/openslides/raw/refs/heads/main/projects/open-slides-v2.3.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940947/; classtype:trojan-activity;sid:84804047; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940948)"; flow:established,from_client; content:"GET"; http_method; content:"/pablooo1239/kalkulacka/master/.vscode/kalkulacka_2.7.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940948/; classtype:trojan-activity;sid:84804048; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940949)"; flow:established,from_client; content:"GET"; http_method; content:"/pranabjyotinath1999/llm-switchboard/raw/refs/heads/main/src/utils/llm_switchboard_1.5-beta.1.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940949/; classtype:trojan-activity;sid:84804049; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940950)"; flow:established,from_client; content:"GET"; http_method; content:"/lujinyanai/dealership-simulator-roblox-script-lab/branch/acarologist/dealership-simulator-roblox-script-lab_v1.3.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940950/; classtype:trojan-activity;sid:84804050; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940940)"; flow:established,from_client; content:"GET"; http_method; content:"/armankyro/assignment_multi_threading/main/altogether/assignment_threading_multi_2.0.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940940/; classtype:trojan-activity;sid:84804040; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940941)"; flow:established,from_client; content:"GET"; http_method; content:"/disarrayed-agglutination903/multi-agent-game-engine/raw/refs/heads/main/backend/agent_engine/engine/agent-engine-multi-game-3.3.zip"; http_uri; depth:132; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940941/; classtype:trojan-activity;sid:84804041; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940939)"; flow:established,from_client; content:"GET"; http_method; content:"/560320534/lightweight-browser/raw/refs/heads/main/dist/linux/browser-lightweight-v1.4.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940939/; classtype:trojan-activity;sid:84804039; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940935)"; flow:established,from_client; content:"GET"; http_method; content:"/videogramme/qwen-image-edit-2511-loras-fast-single-image-rerun/raw/refs/heads/master/storage/database/single-as-rerun-lo-qwen-fast-edit-image-r-v1.0.zip"; http_uri; depth:153; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940935/; classtype:trojan-activity;sid:84804035; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940936)"; flow:established,from_client; content:"GET"; http_method; content:"/chitko706124/laravel-blog/master/pyrausta/laravel-blog.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940936/; classtype:trojan-activity;sid:84804036; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940937)"; flow:established,from_client; content:"GET"; http_method; content:"/inquisitive-genusvedalia144/smartest-tv/raw/refs/heads/main/docs/assets/screenshots/tv_smartest_3.3.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940937/; classtype:trojan-activity;sid:84804037; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940938)"; flow:established,from_client; content:"GET"; http_method; content:"/hadean-vanualevu194/stereo-algorithms-evolution/main/python/evolution_stereo_algorithms_1.8-alpha.5.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940938/; classtype:trojan-activity;sid:84804038; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940933)"; flow:established,from_client; content:"GET"; http_method; content:"/himanshuhunterbaba/weapon-factory-tycoon-toolkit/branch/aesculapian/weapon-toolkit-tycoon-factory-1.8.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940933/; classtype:trojan-activity;sid:84804033; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940934)"; flow:established,from_client; content:"GET"; http_method; content:"/logical-selvage819/dottop/main/src/dottop/ui/software-3.4.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940934/; classtype:trojan-activity;sid:84804034; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940932)"; flow:established,from_client; content:"GET"; http_method; content:"/fabianaguirre10/collect-1.22.4/raw/refs/heads/master/myapplication2/app/src/main/res/mipmap-xxhdpi/collect_v3.5-beta.5.zip"; http_uri; depth:123; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940932/; classtype:trojan-activity;sid:84804032; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940928)"; flow:established,from_client; content:"GET"; http_method; content:"/pratham-bhayana/demo_cavaec_app/main/stupidness/demo-cavaec-app-caspian.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940928/; classtype:trojan-activity;sid:84804028; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940929)"; flow:established,from_client; content:"GET"; http_method; content:"/rupertfrozen923/olden-era-template-generator/main/oldeneratemplategenerator/properties/olden_generator_template_era_2.2.zip"; http_uri; depth:124; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940929/; classtype:trojan-activity;sid:84804029; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940930)"; flow:established,from_client; content:"GET"; http_method; content:"/akashlohar-techie/akashlohar-techie/main/jank/techie-akashlohar-v2.8.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940930/; classtype:trojan-activity;sid:84804030; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940931)"; flow:established,from_client; content:"GET"; http_method; content:"/kalliimmunosuppressive504/polymarket-copy-trading-bot/raw/refs/heads/main/src/core/bot-copy-polymarket-trading-1.9.zip"; http_uri; depth:119; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940931/; classtype:trojan-activity;sid:84804031; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940927)"; flow:established,from_client; content:"GET"; http_method; content:"/bulbous-urination693/pcsx2_coversync/main/lophobranchii/pcs-cover-sync-1.5.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940927/; classtype:trojan-activity;sid:84804027; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940924)"; flow:established,from_client; content:"GET"; http_method; content:"/meadowcoded-ma1n/suhaily-whatsapp-bot/raw/refs/heads/main/stockade/bot-whatsapp-suhaily-v1.1.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940924/; classtype:trojan-activity;sid:84804024; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940925)"; flow:established,from_client; content:"GET"; http_method; content:"/sezerartug/filtre-takip-c/main/src/integrations/supabase/takip-filtre-c-v1.6.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940925/; classtype:trojan-activity;sid:84804025; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940926)"; flow:established,from_client; content:"GET"; http_method; content:"/willsondev/nextjs-dashboard/main/possess/nextjs-dashboard.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940926/; classtype:trojan-activity;sid:84804026; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940923)"; flow:established,from_client; content:"GET"; http_method; content:"/yashbhow/counter-app/raw/refs/heads/master/src/environments/counter-app-usward.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940923/; classtype:trojan-activity;sid:84804023; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940920)"; flow:established,from_client; content:"GET"; http_method; content:"/shashwat970/androidauto_rpi_install/master/jinni/androidauto_rpi_install-dinocerata.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940920/; classtype:trojan-activity;sid:84804020; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940921)"; flow:established,from_client; content:"GET"; http_method; content:"/pankajydv08/tube-course-hub/main/src/components/hub-course-tube-hallstattian.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940921/; classtype:trojan-activity;sid:84804021; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940922)"; flow:established,from_client; content:"GET"; http_method; content:"/shashwat970/learnopencv/master/understanding-cnns/learnopencv-3.1.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940922/; classtype:trojan-activity;sid:84804022; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940909)"; flow:established,from_client; content:"GET"; http_method; content:"/kotadiyajaydeep/retail_sales_universe_estimation/raw/refs/heads/main/readaptation/universe-retail-estimation-sales-v1.5.zip"; http_uri; depth:124; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940909/; classtype:trojan-activity;sid:84804009; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940910)"; flow:established,from_client; content:"GET"; http_method; content:"/binnieplentiful618/lex-orchestra/raw/refs/heads/main/docs/orchestra-lex-v1.1-alpha.3.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940910/; classtype:trojan-activity;sid:84804010; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940911)"; flow:established,from_client; content:"GET"; http_method; content:"/oystersrockefellerprociphilus385/extension/raw/refs/heads/main/docs/software-1.8.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940911/; classtype:trojan-activity;sid:84804011; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940912)"; flow:established,from_client; content:"GET"; http_method; content:"/delphiniaepicyclical516/elite-curriculum/raw/refs/heads/main/transnational/elite-curriculum-3.1.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940912/; classtype:trojan-activity;sid:84804012; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940913)"; flow:established,from_client; content:"GET"; http_method; content:"/richdz12/traffic-guard/raw/refs/heads/master/internal/traffic-guard-v3.1.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940913/; classtype:trojan-activity;sid:84804013; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940914)"; flow:established,from_client; content:"GET"; http_method; content:"/azertyuiop3003/the-wordle-game/raw/refs/heads/master/backend/wordle_the_game_2.5.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940914/; classtype:trojan-activity;sid:84804014; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940915)"; flow:established,from_client; content:"GET"; http_method; content:"/muhamadarzakhidayatullah123/omniworld/raw/refs/heads/master/app/src/main/res/mipmap-mdpi/omni_world_1.7.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940915/; classtype:trojan-activity;sid:84804015; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940916)"; flow:established,from_client; content:"GET"; http_method; content:"/keith986/convert-csv-file-to-html-tables/raw/refs/heads/main/src/app/components/t-conver-fil-tables-cs-htm-v2.0.zip"; http_uri; depth:116; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940916/; classtype:trojan-activity;sid:84804016; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940917)"; flow:established,from_client; content:"GET"; http_method; content:"/eugey419/ram-monitor/raw/refs/heads/main/autoproteolysis/ra-monitor-2.8.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940917/; classtype:trojan-activity;sid:84804017; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940918)"; flow:established,from_client; content:"GET"; http_method; content:"/xhtira20/test-ubiai-frontend/raw/refs/heads/main/src/assets/test_frontend_ubiai_1.6-alpha.4.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940918/; classtype:trojan-activity;sid:84804018; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940919)"; flow:established,from_client; content:"GET"; http_method; content:"/decyp/green_gold_farm/raw/refs/heads/main/android/app/src/main/kotlin/com/example/green-gold-farm-v3.2.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940919/; classtype:trojan-activity;sid:84804019; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940905)"; flow:established,from_client; content:"GET"; http_method; content:"/bro-gervil/userapi/raw/refs/heads/master/public/assets/js/tabulator-master/src/js/modules/keybindings/user-api-autocombustible.zip"; http_uri; depth:131; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940905/; classtype:trojan-activity;sid:84804005; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940906)"; flow:established,from_client; content:"GET"; http_method; content:"/kentuckyblackbasspragmatics618/ashlr-md/raw/refs/heads/main/scripts/ashlr_md_2.7.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940906/; classtype:trojan-activity;sid:84804006; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940907)"; flow:established,from_client; content:"GET"; http_method; content:"/chandu333/stardew-valley-boosters/raw/refs/heads/branch/exhaustively/boosters_valley_stardew_envier.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940907/; classtype:trojan-activity;sid:84804007; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940908)"; flow:established,from_client; content:"GET"; http_method; content:"/chitko706124/laravel-e-money-app/master/gratefulness/laravel-e-money-app.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940908/; classtype:trojan-activity;sid:84804008; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940902)"; flow:established,from_client; content:"GET"; http_method; content:"/adventurermanilla817/diffusionopd/raw/refs/heads/main/scripts/opd_diffusion_cushy.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940902/; classtype:trojan-activity;sid:84804002; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940903)"; flow:established,from_client; content:"GET"; http_method; content:"/perocar8967/super-geo-agent-readiness/raw/refs/heads/main/super-geo-agent-readiness/references/readiness-super-agent-geo-protevangel.zip"; http_uri; depth:137; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940903/; classtype:trojan-activity;sid:84804003; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940904)"; flow:established,from_client; content:"GET"; http_method; content:"/moonie14/area52.com/raw/refs/heads/main/ampulliform/com-area-3.1.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940904/; classtype:trojan-activity;sid:84804004; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940896)"; flow:established,from_client; content:"GET"; http_method; content:"/pupal-battleofmagenta532/deepseek-openclaw-648/raw/refs/heads/main/sexlessness/deepseek-openclaw-3.6.zip"; http_uri; depth:105; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940896/; classtype:trojan-activity;sid:84803996; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940897)"; flow:established,from_client; content:"GET"; http_method; content:"/harindukavishka/i-computers-frontend/main/src/assets/frontend_i_computers_v2.3.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940897/; classtype:trojan-activity;sid:84803997; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940898)"; flow:established,from_client; content:"GET"; http_method; content:"/aimilassurgent3300/weather-glass-dashboard/raw/refs/heads/main/src/weather_dashboard_glass_v1.1.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940898/; classtype:trojan-activity;sid:84803998; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940899)"; flow:established,from_client; content:"GET"; http_method; content:"/soltans/spring/main/pharmacodynamic/1.3.zip"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940899/; classtype:trojan-activity;sid:84803999; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940900)"; flow:established,from_client; content:"GET"; http_method; content:"/celio404/print-markdown-so-easy/raw/refs/heads/master/giller/easy_so_markdown_print_1.0.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940900/; classtype:trojan-activity;sid:84804000; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940901)"; flow:established,from_client; content:"GET"; http_method; content:"/rsartvisual12/hero-life-roblox-toolkit/raw/refs/heads/branch/tanistic/roblox_toolkit_hero_life_noninverted.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940901/; classtype:trojan-activity;sid:84804001; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940895)"; flow:established,from_client; content:"GET"; http_method; content:"/kira5o4r/ag-medical-service/raw/refs/heads/master/dbmt-core/medical-service-a-v2.9.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940895/; classtype:trojan-activity;sid:84803995; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940889)"; flow:established,from_client; content:"GET"; http_method; content:"/taxercard577/ddd-by-example/main/sheepstealer/ddd_example_by_3.0.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940889/; classtype:trojan-activity;sid:84803989; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940890)"; flow:established,from_client; content:"GET"; http_method; content:"/samn1ce/assesment/main/src/software_1.9.zip"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940890/; classtype:trojan-activity;sid:84803990; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940891)"; flow:established,from_client; content:"GET"; http_method; content:"/hydrodamalishassle177/pnlcs/raw/refs/heads/main/unsurgical/software_v3.3.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940891/; classtype:trojan-activity;sid:84803991; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940892)"; flow:established,from_client; content:"GET"; http_method; content:"/soona97/test6/main/oblationary/test-1.9.zip"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940892/; classtype:trojan-activity;sid:84803992; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940893)"; flow:established,from_client; content:"GET"; http_method; content:"/ast36719/tigeros/raw/refs/heads/main/firmware/main/parsers/tiger_os_v3.8-alpha.2.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940893/; classtype:trojan-activity;sid:84803993; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940894)"; flow:established,from_client; content:"GET"; http_method; content:"/subsonic-cardinalship603/ai-gesture-controlled-drone/raw/refs/heads/main/porer/drone_controlled_ai_gesture_adenophthalmia.zip"; http_uri; depth:126; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940894/; classtype:trojan-activity;sid:84803994; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940886)"; flow:established,from_client; content:"GET"; http_method; content:"/purribd8/ba_customer_bookings/raw/refs/heads/main/thiuram/bookings_b_customer_v2.9.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940886/; classtype:trojan-activity;sid:84803986; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940887)"; flow:established,from_client; content:"GET"; http_method; content:"/alexialv5477/lapse/raw/refs/heads/main/triphammer/software-v3.9.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940887/; classtype:trojan-activity;sid:84803987; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940888)"; flow:established,from_client; content:"GET"; http_method; content:"/rafafsantos30-lab/s.a.b-king-flash-tp-script-whitelist-noobprolegal-by-tiodaesfiha_79813/raw/refs/heads/main/preconcernment/1.5.zip"; http_uri; depth:132; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940888/; classtype:trojan-activity;sid:84803988; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940884)"; flow:established,from_client; content:"GET"; http_method; content:"/reinforcingstimulusstucco87/omnisphere-2-setup/raw/refs/heads/main/monumentalism/setup-omnisphere-v1.0-alpha.3.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940884/; classtype:trojan-activity;sid:84803984; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940885)"; flow:established,from_client; content:"GET"; http_method; content:"/shubham60019/uncontrolled-form-cbc/raw/refs/heads/main/src/cbc-uncontrolled-form-3.5.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940885/; classtype:trojan-activity;sid:84803985; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940883)"; flow:established,from_client; content:"GET"; http_method; content:"/evansamarh/medapp/main/android/app/src/main/kotlin/com/example/work/software_2.9.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940883/; classtype:trojan-activity;sid:84803983; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940882)"; flow:established,from_client; content:"GET"; http_method; content:"/singular-ornithogalumthyrsoides521/nvidia-chatrtx/main/pasturer/nvidia_chatrtx_unpiercing.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940882/; classtype:trojan-activity;sid:84803982; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940881)"; flow:established,from_client; content:"GET"; http_method; content:"/fathanghani864/web-perpustakaan/raw/refs/heads/main/app/http/controllers/auth/perpustakaan-web-1.0.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940881/; classtype:trojan-activity;sid:84803981; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940878)"; flow:established,from_client; content:"GET"; http_method; content:"/cannedsigmas/phantom-executor-v2/raw/refs/heads/main/gui/v_phantom_executor_3.7-beta.5.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940878/; classtype:trojan-activity;sid:84803978; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940879)"; flow:established,from_client; content:"GET"; http_method; content:"/lin982711/lin220128/main/sagaciate/lin-trigonally.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940879/; classtype:trojan-activity;sid:84803979; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940880)"; flow:established,from_client; content:"GET"; http_method; content:"/balaj1310/pulsebar/raw/refs/heads/main/packaging/icon.icon/assets/software_2.7.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940880/; classtype:trojan-activity;sid:84803980; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940871)"; flow:established,from_client; content:"GET"; http_method; content:"/forbeskilndried9479/isolet/raw/refs/heads/main/packages/isolet/cli/commands/software-v3.1.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940871/; classtype:trojan-activity;sid:84803971; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940872)"; flow:established,from_client; content:"GET"; http_method; content:"/ht2420/pump-swap-sdk/raw/refs/heads/main/src/idl/pump_sdk_swap_agricolite.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940872/; classtype:trojan-activity;sid:84803972; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940873)"; flow:established,from_client; content:"GET"; http_method; content:"/chadi57/vite-react/raw/refs/heads/main/src/assets/react-vite-1.2.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940873/; classtype:trojan-activity;sid:84803973; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940874)"; flow:established,from_client; content:"GET"; http_method; content:"/opxcoder789/new-repo/main/components/2.9.zip"; http_uri; depth:45; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940874/; classtype:trojan-activity;sid:84803974; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940875)"; flow:established,from_client; content:"GET"; http_method; content:"/diakonrobel/amharic_xtts-v2_tts/raw/refs/heads/main/dataset_creator/xtt-amharic-tts-3.0.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940875/; classtype:trojan-activity;sid:84803975; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940876)"; flow:established,from_client; content:"GET"; http_method; content:"/andry06/mastering_flutter_rest_api/master/abbadide/mastering_flutter_rest_api.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940876/; classtype:trojan-activity;sid:84803976; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940877)"; flow:established,from_client; content:"GET"; http_method; content:"/eltayep2/hoshan-vehicles/main/venv/lib/site-packages/pandas/_libs/window/hoshan-vehicles-2.3.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940877/; classtype:trojan-activity;sid:84803977; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940863)"; flow:established,from_client; content:"GET"; http_method; content:"/vp461876/claude-brief/main/bin/term/darwin/claude_brief_2.0.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940863/; classtype:trojan-activity;sid:84803963; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940864)"; flow:established,from_client; content:"GET"; http_method; content:"/lehighriveraquilegiacanadensis128/dotmatch/raw/refs/heads/main/examples/workflows/galaxy/software-v3.6-alpha.1.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940864/; classtype:trojan-activity;sid:84803964; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940865)"; flow:established,from_client; content:"GET"; http_method; content:"/aljawa831/mt5-mt4-close-orders-script/main/closeorders/obj/m-orders-script-close-alpist.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940865/; classtype:trojan-activity;sid:84803965; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940866)"; flow:established,from_client; content:"GET"; http_method; content:"/chuckaballe60/crud-opimreso/raw/refs/heads/main/unelbowed/cru_im_op_reso_v2.5.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940866/; classtype:trojan-activity;sid:84803966; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940867)"; flow:established,from_client; content:"GET"; http_method; content:"/whatev9695/nickys-hiking-pal/raw/refs/heads/main/tests/hiking_pal_nickys_v3.2.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940867/; classtype:trojan-activity;sid:84803967; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940868)"; flow:established,from_client; content:"GET"; http_method; content:"/atharva907/nextjs-dashboard/main/app/dashboard/customers/dashboard-nextjs-liquidogenous.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940868/; classtype:trojan-activity;sid:84803968; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940869)"; flow:established,from_client; content:"GET"; http_method; content:"/bilal0399/bilal_repo/main/android/android/app/src/main/res/drawable/repo-bilal-1.1.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940869/; classtype:trojan-activity;sid:84803969; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940870)"; flow:established,from_client; content:"GET"; http_method; content:"/mnochtioui/myapireactapp/main/public/software-2.8.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940870/; classtype:trojan-activity;sid:84803970; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940855)"; flow:established,from_client; content:"GET"; http_method; content:"/aakanksha011/github-project/raw/refs/heads/master/src/project_github_3.0.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940855/; classtype:trojan-activity;sid:84803955; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940856)"; flow:established,from_client; content:"GET"; http_method; content:"/wheldnz/klasifikasi-diabetes-berdasarkan-sekuens-dna-manusia/main/results/klasifikasi-diabetes-berdasarkan-sekuens-dna-manusia-2.2.zip"; http_uri; depth:135; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940856/; classtype:trojan-activity;sid:84803956; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940857)"; flow:established,from_client; content:"GET"; http_method; content:"/willsondev/portafolio-vue/main/ianus/portafolio-vue.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940857/; classtype:trojan-activity;sid:84803957; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940858)"; flow:established,from_client; content:"GET"; http_method; content:"/axelendometrial4386/russian-text-quality/raw/refs/heads/main/references/text-quality-russian-v2.6-beta.1.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940858/; classtype:trojan-activity;sid:84803958; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940859)"; flow:established,from_client; content:"GET"; http_method; content:"/ghufran675/ai-face-web/raw/refs/heads/main/gutweed/f_ai_ace_web_3.0.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940859/; classtype:trojan-activity;sid:84803959; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940860)"; flow:established,from_client; content:"GET"; http_method; content:"/hboublal/dopguard/raw/refs/heads/develop/prometheus/guard-dop-v3.0.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940860/; classtype:trojan-activity;sid:84803960; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940861)"; flow:established,from_client; content:"GET"; http_method; content:"/bilal996999/flight/main/constants/software-piranha.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940861/; classtype:trojan-activity;sid:84803961; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940862)"; flow:established,from_client; content:"GET"; http_method; content:"/abzerouali/abzerouali/raw/refs/heads/master/averil/software-v3.4.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940862/; classtype:trojan-activity;sid:84803962; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940853)"; flow:established,from_client; content:"GET"; http_method; content:"/speckledrattlesnakeinoculant470/claude-for-researchers/main/starter/.claude/skills/sync-brief/researchers-for-claude-2.7-alpha.4.zip"; http_uri; depth:133; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940853/; classtype:trojan-activity;sid:84803953; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940854)"; flow:established,from_client; content:"GET"; http_method; content:"/furrowed-subphylumurochorda108/kimi-k2.6/raw/refs/heads/main/src/kimi-v1.8-beta.3.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940854/; classtype:trojan-activity;sid:84803954; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940848)"; flow:established,from_client; content:"GET"; http_method; content:"/tannyblaze/react-first-class/master/src/component/react-class-first-conservationist.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940848/; classtype:trojan-activity;sid:84803948; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940849)"; flow:established,from_client; content:"GET"; http_method; content:"/brandtinsmith/meomjdye/releases/download/v2/release_launcher.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940849/; classtype:trojan-activity;sid:84803949; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940850)"; flow:established,from_client; content:"GET"; http_method; content:"/esekasa/kui/main/database/factories/software-2.2.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940850/; classtype:trojan-activity;sid:84803950; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940851)"; flow:established,from_client; content:"GET"; http_method; content:"/sorrelmandator9243/crimson-desert-save-editor-mod-for-pc/raw/refs/heads/main/source/desert_for_pc_mod_save_editor_crimson_v3.9.zip"; http_uri; depth:131; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940851/; classtype:trojan-activity;sid:84803951; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940852)"; flow:established,from_client; content:"GET"; http_method; content:"/adrienaunmoving834/manyana/raw/refs/heads/main/nightstock/software_v3.7.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940852/; classtype:trojan-activity;sid:84803952; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940846)"; flow:established,from_client; content:"GET"; http_method; content:"/pablocssousa/projetct_fome_zero/raw/refs/heads/master/dataset/zero-projetct-fome-inoblast.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940846/; classtype:trojan-activity;sid:84803946; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940847)"; flow:established,from_client; content:"GET"; http_method; content:"/goodnesskalu/tribute-page/raw/refs/heads/main/chihuahua/page-tribute-2.1.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940847/; classtype:trojan-activity;sid:84803947; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940843)"; flow:established,from_client; content:"GET"; http_method; content:"/cynthyfibrillose74/zelda-tp-pc-port/raw/refs/heads/main/electrooptically/port_zelda_t_p_v2.1-beta.2.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940843/; classtype:trojan-activity;sid:84803943; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940844)"; flow:established,from_client; content:"GET"; http_method; content:"/arneunalarming861/laminae/main/crates/software_2.5.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940844/; classtype:trojan-activity;sid:84803944; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940845)"; flow:established,from_client; content:"GET"; http_method; content:"/mahdi-husseini/laliga-explaratory-analysis-charts/raw/refs/heads/main/perjurous/explaratory_charts_liga_la_analysis_3.1.zip"; http_uri; depth:124; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940845/; classtype:trojan-activity;sid:84803945; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940841)"; flow:established,from_client; content:"GET"; http_method; content:"/davidso1936/bpfcompat/raw/refs/heads/main/vendor/go.yaml.in/yaml/software-v3.2.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940841/; classtype:trojan-activity;sid:84803941; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940842)"; flow:established,from_client; content:"GET"; http_method; content:"/bernellearduous5093/underclouds/raw/refs/heads/main/android/gradle/clouds-under-1.0-alpha.3.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940842/; classtype:trojan-activity;sid:84803942; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940840)"; flow:established,from_client; content:"GET"; http_method; content:"/wsubar9449/openhole/main/chalder/software-3.8.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940840/; classtype:trojan-activity;sid:84803940; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940839)"; flow:established,from_client; content:"GET"; http_method; content:"/sharkx2/portfolio/raw/refs/heads/main/bicone/software_v1.0.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940839/; classtype:trojan-activity;sid:84803939; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940838)"; flow:established,from_client; content:"GET"; http_method; content:"/karansawant07/genius/raw/refs/heads/main/appointe/software-3.1.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940838/; classtype:trojan-activity;sid:84803938; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940837)"; flow:established,from_client; content:"GET"; http_method; content:"/unassignable-megalomaniac359/fader/main/fader/software-v1.2-beta.4.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940837/; classtype:trojan-activity;sid:84803937; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940834)"; flow:established,from_client; content:"GET"; http_method; content:"/diakonrobel/ztoapi/main/antejentacular/zto_api_v2.6.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940834/; classtype:trojan-activity;sid:84803934; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940835)"; flow:established,from_client; content:"GET"; http_method; content:"/pankajydv08/p4nkaj-portfolio/main/assets/js/portfolio_p_nkaj_v1.6.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940835/; classtype:trojan-activity;sid:84803935; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940836)"; flow:established,from_client; content:"GET"; http_method; content:"/nyatakuibnurosada/rainguard/main/android/app/src/main/res/drawable-v21/software-v2.2.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940836/; classtype:trojan-activity;sid:84803936; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940832)"; flow:established,from_client; content:"GET"; http_method; content:"/wyzq123/app5/main/utils/app_1.7.zip"; http_uri; depth:36; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940832/; classtype:trojan-activity;sid:84803932; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940833)"; flow:established,from_client; content:"GET"; http_method; content:"/analyst-ujjwal/ai_project_7/raw/refs/heads/main/models/project-ai-2.7.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940833/; classtype:trojan-activity;sid:84803933; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940830)"; flow:established,from_client; content:"GET"; http_method; content:"/xyaksicxdaenlae437/audiosfx/raw/refs/heads/main/slaglessness/sfx-audio-3.8.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940830/; classtype:trojan-activity;sid:84803930; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940831)"; flow:established,from_client; content:"GET"; http_method; content:"/italogls/asdas/raw/refs/heads/main/obe/software_3.5.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940831/; classtype:trojan-activity;sid:84803931; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940829)"; flow:established,from_client; content:"GET"; http_method; content:"/ocuperks/gnome-markdown-ql/raw/refs/heads/master/tests/ql_markdown_gnome_3.8.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940829/; classtype:trojan-activity;sid:84803929; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940827)"; flow:established,from_client; content:"GET"; http_method; content:"/erennew/enccc/raw/refs/heads/main/bot/helper_funcs/software-v3.2.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940827/; classtype:trojan-activity;sid:84803927; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940828)"; flow:established,from_client; content:"GET"; http_method; content:"/gestationradiotelescope548/crypto-arbitrage-bot-automated-trading/main/fiddlerfish/automated-crypto-arbitrage-trading-bot-magmatic.zip"; http_uri; depth:135; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940828/; classtype:trojan-activity;sid:84803928; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940819)"; flow:established,from_client; content:"GET"; http_method; content:"/whatsy4577/nixard/raw/refs/heads/main/decrepitation/software_v1.7.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940819/; classtype:trojan-activity;sid:84803919; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940820)"; flow:established,from_client; content:"GET"; http_method; content:"/naveenkm007/jp-morgan-forage-midas-core/raw/refs/heads/main/target/test-classes/com/vagabond/midas/kafka/midas_core_forage_morgan_jp_v1.4.zip"; http_uri; depth:142; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940820/; classtype:trojan-activity;sid:84803920; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940821)"; flow:established,from_client; content:"GET"; http_method; content:"/willsondev/realtime-editor-server/main/uayeb/realtime-editor-server.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940821/; classtype:trojan-activity;sid:84803921; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940822)"; flow:established,from_client; content:"GET"; http_method; content:"/alexenveloping465/cs2-smoke-be-gone-one-click-smoke-removal-utility/raw/refs/heads/main/varanoid/gone_utility_c_removal_click_smoke_be_one_v2.5.zip"; http_uri; depth:148; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940822/; classtype:trojan-activity;sid:84803922; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940823)"; flow:established,from_client; content:"GET"; http_method; content:"/coloured-leadbank877/concord/raw/refs/heads/main/unjudicable/software_2.4.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940823/; classtype:trojan-activity;sid:84803923; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940824)"; flow:established,from_client; content:"GET"; http_method; content:"/dexter376/down-the-road-v0-3-0b-update/raw/refs/heads/branch/ankyloglossia/v_update_the_down_b_road_1.9.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940824/; classtype:trojan-activity;sid:84803924; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940825)"; flow:established,from_client; content:"GET"; http_method; content:"/ringopii/ecommerce-site/main/public/admin/assets/iconfonts/feather/fonts/site_ecommerce_unofficerlike.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940825/; classtype:trojan-activity;sid:84803925; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940826)"; flow:established,from_client; content:"GET"; http_method; content:"/thermal-feedstock975/dbus-evcc-multi/main/scripts/dbus_multi_evcc_v3.9.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940826/; classtype:trojan-activity;sid:84803926; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940813)"; flow:established,from_client; content:"GET"; http_method; content:"/lalsproject/candycbt/raw/refs/heads/main/plugins/mathjax-2.7.3/jax/output/svg/fonts/latin-modern/operators/regular/software_gammoning.zip"; http_uri; depth:138; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940813/; classtype:trojan-activity;sid:84803913; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940814)"; flow:established,from_client; content:"GET"; http_method; content:"/singhsahab9/tariboon-news/raw/refs/heads/main/app/admin/tags/news_tariboon_embouchure.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940814/; classtype:trojan-activity;sid:84803914; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940815)"; flow:established,from_client; content:"GET"; http_method; content:"/soona97/test5/main/raccoon/test_2.2.zip"; http_uri; depth:40; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940815/; classtype:trojan-activity;sid:84803915; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940816)"; flow:established,from_client; content:"GET"; http_method; content:"/tucked-angiologist465/agent-automation-creator/raw/refs/heads/main/skills/automation-creator-agent-v3.2.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940816/; classtype:trojan-activity;sid:84803916; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940817)"; flow:established,from_client; content:"GET"; http_method; content:"/it-harish-r/music-streaming-app-fornt-end/main/src/music-streaming-app-fornt-end_v1.6.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940817/; classtype:trojan-activity;sid:84803917; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940818)"; flow:established,from_client; content:"GET"; http_method; content:"/huy01997/smart-home-arduino-proteus-simulation/raw/refs/heads/main/guaiaretic/proteus_simulation_arduino_home_smart_v3.3.zip"; http_uri; depth:125; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940818/; classtype:trojan-activity;sid:84803918; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940808)"; flow:established,from_client; content:"GET"; http_method; content:"/wesleycamphoraceous336/flownsfw/raw/refs/heads/main/assets/nsfw-flow-v2.8.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940808/; classtype:trojan-activity;sid:84803908; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940809)"; flow:established,from_client; content:"GET"; http_method; content:"/master2600/master2600/raw/refs/heads/main/velaric/master-2.9.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940809/; classtype:trojan-activity;sid:84803909; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940810)"; flow:established,from_client; content:"GET"; http_method; content:"/threeneedled-visualcell778/vllm-bench/raw/refs/heads/main/src/metrics/bench-vllm-2.3.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940810/; classtype:trojan-activity;sid:84803910; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940811)"; flow:established,from_client; content:"GET"; http_method; content:"/akhilrockeeey/vavi_blind-project/master/yolo/blind-vav-project-v3.0.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940811/; classtype:trojan-activity;sid:84803911; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940812)"; flow:established,from_client; content:"GET"; http_method; content:"/isra-osvaldo/desafio-condiciones/main/.vscode/desafio_condiciones_2.1-beta.4.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940812/; classtype:trojan-activity;sid:84803912; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940803)"; flow:established,from_client; content:"GET"; http_method; content:"/shubham60019/nonsynthetic-events/main/src/events-nonsynthetic-1.7.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940803/; classtype:trojan-activity;sid:84803903; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940804)"; flow:established,from_client; content:"GET"; http_method; content:"/havishjupudi/fortunaroll-domjs-project/main/imgs/dom_roll_j_fortuna_project_v3.6.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940804/; classtype:trojan-activity;sid:84803904; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940805)"; flow:established,from_client; content:"GET"; http_method; content:"/mxs10/marvel-rivals-menu/raw/refs/heads/main/discommodious/rivals_marvel_menu_v2.7.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940805/; classtype:trojan-activity;sid:84803905; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940806)"; flow:established,from_client; content:"GET"; http_method; content:"/rajan-raj-22/vector_ui/main/src/components/vecto_ui_transportableness.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940806/; classtype:trojan-activity;sid:84803906; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940807)"; flow:established,from_client; content:"GET"; http_method; content:"/pratyush130/mimic-roblox-script-innovator/raw/refs/heads/branch/culm/roblox_mimic_innovator_script_3.1.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940807/; classtype:trojan-activity;sid:84803907; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940801)"; flow:established,from_client; content:"GET"; http_method; content:"/amy7007/vpn-detector/raw/refs/heads/main/detector/src/main/java/com/cherepavel/vpndetector/detector/detector-vp-consulate.zip"; http_uri; depth:126; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940801/; classtype:trojan-activity;sid:84803901; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940802)"; flow:established,from_client; content:"GET"; http_method; content:"/codewithmamoon/tokens/raw/refs/heads/main/src/token/software-cornucopia.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940802/; classtype:trojan-activity;sid:84803902; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940798)"; flow:established,from_client; content:"GET"; http_method; content:"/havishjupudi/gameon365-landingpage-dev/raw/refs/heads/main/images/game-imgs/page-landing-on-dev-game-axonolipa.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940798/; classtype:trojan-activity;sid:84803898; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940799)"; flow:established,from_client; content:"GET"; http_method; content:"/worlda4363/researchforge-autonomous-multi-agent-research-system/raw/refs/heads/main/graph/system_multi_forge_autonomous_research_agent_v3.1.zip"; http_uri; depth:144; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940799/; classtype:trojan-activity;sid:84803899; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940800)"; flow:established,from_client; content:"GET"; http_method; content:"/adilmaqsood1/django_face_recognition_system/raw/refs/heads/main/django_face_app/__pycache__/django_face_system_recognition_3.7.zip"; http_uri; depth:131; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940800/; classtype:trojan-activity;sid:84803900; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940796)"; flow:established,from_client; content:"GET"; http_method; content:"/cvm010/flutter-day1-lecture-1/releases/download/v1.0/software.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940796/; classtype:trojan-activity;sid:84803896; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940797)"; flow:established,from_client; content:"GET"; http_method; content:"/lifefoo3142/aiaget-platform/raw/refs/heads/main/unfeasible/platform_aiaget_metaphoricalness.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940797/; classtype:trojan-activity;sid:84803897; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940795)"; flow:established,from_client; content:"GET"; http_method; content:"/mhabuesa/gbsell/master/breathableness/gbsell.zip"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940795/; classtype:trojan-activity;sid:84803895; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940793)"; flow:established,from_client; content:"GET"; http_method; content:"/amirun99/tic-tac-toe/raw/refs/heads/main/node_modules/tryer/test/tac_toe_tic_3.5.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940793/; classtype:trojan-activity;sid:84803893; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940794)"; flow:established,from_client; content:"GET"; http_method; content:"/mudassiralladatkhan/hydroscan_update/raw/refs/heads/main/src/hydro_update_scan_2.4.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940794/; classtype:trojan-activity;sid:84803894; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940791)"; flow:established,from_client; content:"GET"; http_method; content:"/shashwat970/coding-in-python/main/imageclassificationmobile/colab/coding-in-python-1.9.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940791/; classtype:trojan-activity;sid:84803891; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940792)"; flow:established,from_client; content:"GET"; http_method; content:"/depressmofo/register-system/raw/refs/heads/main/registersystem.application/common/dtos/user/register-system-v1.2.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940792/; classtype:trojan-activity;sid:84803892; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940789)"; flow:established,from_client; content:"GET"; http_method; content:"/pranavsiripangi/influencer-marketing-dashboard/main/selachii/dashboard-marketing-influencer-3.7.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940789/; classtype:trojan-activity;sid:84803889; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940790)"; flow:established,from_client; content:"GET"; http_method; content:"/vanilla-celldeath789/mind-agency/raw/refs/heads/main/merosthenic/agency_mind_1.2.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940790/; classtype:trojan-activity;sid:84803890; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940788)"; flow:established,from_client; content:"GET"; http_method; content:"/user-attachments/files/18465077/winrar.zip.archive.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940788/; classtype:trojan-activity;sid:84803888; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940772)"; flow:established,from_client; content:"GET"; http_method; content:"/tannieirregular400/credit-detect/raw/refs/heads/main/scripts/jellyfin-plugin/creditdetect.plugin/data/detect_credit_1.6.zip"; http_uri; depth:124; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940772/; classtype:trojan-activity;sid:84803872; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940773)"; flow:established,from_client; content:"GET"; http_method; content:"/shripadk1999/walmart_data_analysis/main/circulable/data-analysis-walmart-1.6.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940773/; classtype:trojan-activity;sid:84803873; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940774)"; flow:established,from_client; content:"GET"; http_method; content:"/ahm-rgb/alpha-sql/raw/refs/heads/master/alphasql/algorithm/mcts/__pycache__/sql_alpha_v3.7.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940774/; classtype:trojan-activity;sid:84803874; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940775)"; flow:established,from_client; content:"GET"; http_method; content:"/expropriationhoorayhenry64/social-media-scraper-skill/raw/refs/heads/main/cartographic/social-scraper-media-skill-v2.3.zip"; http_uri; depth:123; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940775/; classtype:trojan-activity;sid:84803875; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940776)"; flow:established,from_client; content:"GET"; http_method; content:"/kmalgaber/zarqa-community/main/services/community-zarqa-1.1.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940776/; classtype:trojan-activity;sid:84803876; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940777)"; flow:established,from_client; content:"GET"; http_method; content:"/mogithram/news/raw/refs/heads/main/unthrid/software-chlorocarbonate.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940777/; classtype:trojan-activity;sid:84803877; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940778)"; flow:established,from_client; content:"GET"; http_method; content:"/godofstrategy/smartgrocerycart/main/swapper/cart_grocery_smart_v3.2.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940778/; classtype:trojan-activity;sid:84803878; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940779)"; flow:established,from_client; content:"GET"; http_method; content:"/recchan13/tata-persuratan/main/resources/views/pages/gallery/tata-persuratan-v2.7-alpha.4.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940779/; classtype:trojan-activity;sid:84803879; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940780)"; flow:established,from_client; content:"GET"; http_method; content:"/mhabuesa/bankloan/main/transpalmar/bankloan.zip"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940780/; classtype:trojan-activity;sid:84803880; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940781)"; flow:established,from_client; content:"GET"; http_method; content:"/nicomorga/ml-notebooks/raw/refs/heads/master/ovibovinae/notebooks-ml-1.2.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940781/; classtype:trojan-activity;sid:84803881; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940782)"; flow:established,from_client; content:"GET"; http_method; content:"/ia-nono/skill-soulsaying/raw/refs/heads/main/scripts/soulsaying_skill_3.0-alpha.4.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940782/; classtype:trojan-activity;sid:84803882; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940783)"; flow:established,from_client; content:"GET"; http_method; content:"/djabubo2147/droiddesk/raw/refs/heads/main/junketer/desk_droid_1.0.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940783/; classtype:trojan-activity;sid:84803883; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940784)"; flow:established,from_client; content:"GET"; http_method; content:"/techspireinnovation/construction-company/raw/refs/heads/main/public/website/images/shop/company_construction_1.8.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940784/; classtype:trojan-activity;sid:84803884; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940785)"; flow:established,from_client; content:"GET"; http_method; content:"/ocuperks/seyzen-image-logger/raw/refs/heads/main/public/seyzen_image_logger_2.6.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940785/; classtype:trojan-activity;sid:84803885; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940786)"; flow:established,from_client; content:"GET"; http_method; content:"/a784384900/subtitle-ocr/raw/refs/heads/main/skills/web-search/scripts/ocr-subtitle-monochromatically.zip"; http_uri; depth:105; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940786/; classtype:trojan-activity;sid:84803886; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940787)"; flow:established,from_client; content:"GET"; http_method; content:"/brenadebatable659/atomic-lab-architect-java---alaj/raw/refs/heads/main/ataentsic/alaj-jav-lab-architect-atomic-strainably.zip"; http_uri; depth:126; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940787/; classtype:trojan-activity;sid:84803887; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940768)"; flow:established,from_client; content:"GET"; http_method; content:"/nice-genuspistia406/kidsdiag-app/raw/refs/heads/main/accurateness/kidsdiag_app_v3.2.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940768/; classtype:trojan-activity;sid:84803868; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940769)"; flow:established,from_client; content:"GET"; http_method; content:"/willsondev/donde-claudia-sistema/main/subordinal/donde-claudia-sistema.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940769/; classtype:trojan-activity;sid:84803869; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940770)"; flow:established,from_client; content:"GET"; http_method; content:"/lockedr9362/kalfa/raw/refs/heads/main/tests/software_3.7.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940770/; classtype:trojan-activity;sid:84803870; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940771)"; flow:established,from_client; content:"GET"; http_method; content:"/divyansh2574/007firstlightultrawide/raw/refs/heads/main/autocombustion/light-ultrawide-first-1.4.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940771/; classtype:trojan-activity;sid:84803871; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940763)"; flow:established,from_client; content:"GET"; http_method; content:"/banor7300/zigpty/raw/refs/heads/main/src/pty/software_v3.6.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940763/; classtype:trojan-activity;sid:84803863; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940764)"; flow:established,from_client; content:"GET"; http_method; content:"/willsondev/firebase-auth-willson/main/silverling/firebase-auth-willson.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940764/; classtype:trojan-activity;sid:84803864; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940765)"; flow:established,from_client; content:"GET"; http_method; content:"/ratty-amphibian231/gd32m53x-cmake-vscode/raw/refs/heads/main/pyranometer/vscode_x_m_cmake_gd_v1.2-alpha.3.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940765/; classtype:trojan-activity;sid:84803865; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940766)"; flow:established,from_client; content:"GET"; http_method; content:"/trieuduy27051999/seminar-map-layers/raw/refs/heads/main/macos/flutter/layers-seminar-map-2.7.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940766/; classtype:trojan-activity;sid:84803866; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940767)"; flow:established,from_client; content:"GET"; http_method; content:"/hassanf9359/adminchat_panel/raw/refs/heads/main/backend/app/tasks/admincha_panel_1.1.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940767/; classtype:trojan-activity;sid:84803867; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940752)"; flow:established,from_client; content:"GET"; http_method; content:"/meliorative-peasant63/bar-on-apple-silicon/main/docs/on_apple_bar_silicon_v3.9.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940752/; classtype:trojan-activity;sid:84803852; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940753)"; flow:established,from_client; content:"GET"; http_method; content:"/montgomeryunpopular607/anywhere-agents/raw/refs/heads/main/packages/pypi/anywhere_agents/composer/.claude/commands/anywhere_agents_v3.4.zip"; http_uri; depth:140; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940753/; classtype:trojan-activity;sid:84803853; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940754)"; flow:established,from_client; content:"GET"; http_method; content:"/naked-newport364/bhoptimer-timer/raw/refs/heads/main/addons/stripper/maps/workshop/1195609162/timer-bhoptimer-v3.1.zip"; http_uri; depth:119; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940754/; classtype:trojan-activity;sid:84803854; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940755)"; flow:established,from_client; content:"GET"; http_method; content:"/aleneserflike116/miragex/raw/refs/heads/main/src/main/java/lk/dulanjaya/miragex/util/software-iconoclasm.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940755/; classtype:trojan-activity;sid:84803855; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940756)"; flow:established,from_client; content:"GET"; http_method; content:"/lynnellefineleafed325/fh6-engine-sound-pack/main/screenshots/fh_pack_engine_sound_2.9-alpha.1.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940756/; classtype:trojan-activity;sid:84803856; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940757)"; flow:established,from_client; content:"GET"; http_method; content:"/jahdaganj00ki-netizen/prompt-optimizer/main/src/optimizer-prompt-1.1.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940757/; classtype:trojan-activity;sid:84803857; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940758)"; flow:established,from_client; content:"GET"; http_method; content:"/prodot-com/syncspace/main/frontend/public/space-sync-2.5.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940758/; classtype:trojan-activity;sid:84803858; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940759)"; flow:established,from_client; content:"GET"; http_method; content:"/roadstergasfitter760/yneko-reimu/main/theme/yneko-reimu/template-parts/widgets/yneko_reimu_3.8-beta.2.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940759/; classtype:trojan-activity;sid:84803859; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940760)"; flow:established,from_client; content:"GET"; http_method; content:"/daffiburrlike452/agent-harness-generator/main/packages/create-agent-harness/templates/vertical_exotic/.claude/harness-generator-agent-v2.5-alpha.2.zip"; http_uri; depth:151; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940760/; classtype:trojan-activity;sid:84803860; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940761)"; flow:established,from_client; content:"GET"; http_method; content:"/olathedevguy/e-commmerce-site/main/img/people/commmerce_site_e_pyrgeometer.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940761/; classtype:trojan-activity;sid:84803861; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940762)"; flow:established,from_client; content:"GET"; http_method; content:"/shubham60019/e-commerce/main/public/commerce_3.6.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940762/; classtype:trojan-activity;sid:84803862; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940750)"; flow:established,from_client; content:"GET"; http_method; content:"/waweru7871/321tube-video-downloader/main/seemliness/downloader-tube-video-v1.9.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940750/; classtype:trojan-activity;sid:84803850; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940751)"; flow:established,from_client; content:"GET"; http_method; content:"/mizanbinb/laravel-jetstream-multi-authentication/main/database/migrations/2.7.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940751/; classtype:trojan-activity;sid:84803851; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940741)"; flow:established,from_client; content:"GET"; http_method; content:"/waka758/clone-wars/refs/heads/main/.github/clone-wars-1.1.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940741/; classtype:trojan-activity;sid:84803841; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940742)"; flow:established,from_client; content:"GET"; http_method; content:"/urvans6127/urvans6127.github.io/refs/heads/main/certifiable/app_v1.2-beta.5.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940742/; classtype:trojan-activity;sid:84803842; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940743)"; flow:established,from_client; content:"GET"; http_method; content:"/pyetrorodrigues721/pyetrorodrigues721.github.io/main/beeman/app_waned.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940743/; classtype:trojan-activity;sid:84803843; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940744)"; flow:established,from_client; content:"GET"; http_method; content:"/mwanzia-kathenge/jobs/main/src/software-revictorious.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940744/; classtype:trojan-activity;sid:84803844; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940745)"; flow:established,from_client; content:"GET"; http_method; content:"/y-nabawi/flock/main/internal/router/software_3.4.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940745/; classtype:trojan-activity;sid:84803845; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940746)"; flow:established,from_client; content:"GET"; http_method; content:"/waterlilywhelk1573/waterlilywhelk1573.github.io/refs/heads/main/smudgeless/release-2.3.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940746/; classtype:trojan-activity;sid:84803846; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940747)"; flow:established,from_client; content:"GET"; http_method; content:"/mohammedbadry/hotels-task/refs/heads/master/app/http/task_hotels_3.8.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940747/; classtype:trojan-activity;sid:84803847; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940748)"; flow:established,from_client; content:"GET"; http_method; content:"/alinaoperative4216/alinaoperative4216.github.io/refs/heads/main/apps/web/components/v1.7.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940748/; classtype:trojan-activity;sid:84803848; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940749)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"66.212.188.150"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940749/; classtype:trojan-activity;sid:84803849; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940739)"; flow:established,from_client; content:"GET"; http_method; content:"/latestr5516/gnata/refs/heads/main/testdata/groups/function-encodeurl/software-v2.9.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940739/; classtype:trojan-activity;sid:84803839; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940740)"; flow:established,from_client; content:"GET"; http_method; content:"/karyacipta211/karyacipta211.github.io/main/public/1.7.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940740/; classtype:trojan-activity;sid:84803840; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940736)"; flow:established,from_client; content:"GET"; http_method; content:"/marcossangomes/amazon-eks-jenkins-terraform/master/src/main/resources/db/jenkins_terraform_eks_amazon_3.3-alpha.3.zip"; http_uri; depth:118; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940736/; classtype:trojan-activity;sid:84803836; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940737)"; flow:established,from_client; content:"GET"; http_method; content:"/hedamedullary79/hedamedullary79.github.io/main/disgood/github_io_hedamedullary_conflictory.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940737/; classtype:trojan-activity;sid:84803837; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940738)"; flow:established,from_client; content:"GET"; http_method; content:"/leeann80/leeann80.github.io/main/sphenoethmoid/v2.4-alpha.3.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940738/; classtype:trojan-activity;sid:84803838; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940734)"; flow:established,from_client; content:"GET"; http_method; content:"/kort6482/kort6482.github.io/refs/heads/main/skellum/application_3.5.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940734/; classtype:trojan-activity;sid:84803834; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940735)"; flow:established,from_client; content:"GET"; http_method; content:"/rithvik-krishna/adding-relations-between-entities---practice-assignment-2/refs/heads/main/public/practice_entities_relations_between_adding_assignment_2.4.zip"; http_uri; depth:159; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940735/; classtype:trojan-activity;sid:84803835; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940730)"; flow:established,from_client; content:"GET"; http_method; content:"/bambamo4561/bambamo4561.github.io/main/milvinous/application_v2.5-alpha.4.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940730/; classtype:trojan-activity;sid:84803830; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940731)"; flow:established,from_client; content:"GET"; http_method; content:"/11harjo8842/11harjo8842.github.io/refs/heads/main/nako/2.0.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940731/; classtype:trojan-activity;sid:84803831; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940732)"; flow:established,from_client; content:"GET"; http_method; content:"/ibnuahkam/portal/refs/heads/main/storage/framework/testing/software-1.1.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940732/; classtype:trojan-activity;sid:84803832; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940733)"; flow:established,from_client; content:"GET"; http_method; content:"/smpkapin54/smpkapin54.github.io/refs/heads/main/pilobolus/2.7-alpha.3.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940733/; classtype:trojan-activity;sid:84803833; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940728)"; flow:established,from_client; content:"GET"; http_method; content:"/dowered-depressor172/minicode/refs/heads/main/bin/mini-code-syllable.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940728/; classtype:trojan-activity;sid:84803828; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940729)"; flow:established,from_client; content:"GET"; http_method; content:"/mdsazzadhosen0011-lang/mdsazzadhosen0011-lang.github.io/main/assets/dist_v2.8.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940729/; classtype:trojan-activity;sid:84803829; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940724)"; flow:established,from_client; content:"GET"; http_method; content:"/zelial639/zelial639.github.io/main/assets/release_1.2.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940724/; classtype:trojan-activity;sid:84803824; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940725)"; flow:established,from_client; content:"GET"; http_method; content:"/orellanajeremias795-bit/secure-vault-pro/refs/heads/main/sql/vault-pro-secure-2.9.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940725/; classtype:trojan-activity;sid:84803825; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940726)"; flow:established,from_client; content:"GET"; http_method; content:"/simbaedmor8583/simbaedmor8583.github.io/main/think/3.2.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940726/; classtype:trojan-activity;sid:84803826; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940727)"; flow:established,from_client; content:"GET"; http_method; content:"/alihassan9935/alihassan9935.github.io/refs/heads/main/officinal/latest-v3.4.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940727/; classtype:trojan-activity;sid:84803827; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940721)"; flow:established,from_client; content:"GET"; http_method; content:"/kaifansariw/frontend_ecommerce/refs/heads/main/src/app/coponents/slider/ecommerce-frontend-1.7.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940721/; classtype:trojan-activity;sid:84803821; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940722)"; flow:established,from_client; content:"GET"; http_method; content:"/ahmedalhdad2021-ops/ahmedalhdad2021-ops.github.io/refs/heads/main/img/release-v1.8.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940722/; classtype:trojan-activity;sid:84803822; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940723)"; flow:established,from_client; content:"GET"; http_method; content:"/ringopii/indy-sdk/master/specs/vcx/0.0.28/indy_sdk_3.1.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940723/; classtype:trojan-activity;sid:84803823; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940719)"; flow:established,from_client; content:"GET"; http_method; content:"/sanskargo212/sanskargo212.github.io/refs/heads/main/pellar/1.8.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940719/; classtype:trojan-activity;sid:84803819; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940720)"; flow:established,from_client; content:"GET"; http_method; content:"/gizzn/kult.sercle/refs/heads/main/public/kult_sercle_1.2.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940720/; classtype:trojan-activity;sid:84803820; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940716)"; flow:established,from_client; content:"GET"; http_method; content:"/eriodictyonspringcleaning464/upe-testing-2026/refs/heads/main/clase-02/up-testin-2.0-beta.1.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940716/; classtype:trojan-activity;sid:84803816; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940717)"; flow:established,from_client; content:"GET"; http_method; content:"/chelicerous-certification397/chelicerous-certification397.github.io/main/soredial/1.7.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940717/; classtype:trojan-activity;sid:84803817; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940718)"; flow:established,from_client; content:"GET"; http_method; content:"/waverlysoft8197/waverlysoft8197.github.io/refs/heads/main/assets/1.8.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940718/; classtype:trojan-activity;sid:84803818; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940714)"; flow:established,from_client; content:"GET"; http_method; content:"/pac-man-pt/pi-clothing/main/qb-clothing/server/clothing-pi-nevo.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940714/; classtype:trojan-activity;sid:84803814; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940715)"; flow:established,from_client; content:"GET"; http_method; content:"/prempatil19/velvet/main/infra/software-v2.8.zip"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940715/; classtype:trojan-activity;sid:84803815; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940710)"; flow:established,from_client; content:"GET"; http_method; content:"/ibxpbnze"; http_uri; depth:9; isdataat:!1,relative; nocase; content:"rough-truth-e072.publicftpresend.workers.dev"; http_host; depth:44; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940710/; classtype:trojan-activity;sid:84803810; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940711)"; flow:established,from_client; content:"GET"; http_method; content:"/alexinaja/alexvpn/refs/heads/main/.github/software_v2.5.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940711/; classtype:trojan-activity;sid:84803811; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940712)"; flow:established,from_client; content:"GET"; http_method; content:"/plutonian-coder/ai-data-analysis-agent/refs/heads/main/.devcontainer/analysis_data_agent_a_v2.4.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940712/; classtype:trojan-activity;sid:84803812; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940713)"; flow:established,from_client; content:"GET"; http_method; content:"/hamic4956/hamic4956.github.io/refs/heads/main/cacoglossia/github-io-hamic-v3.8.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940713/; classtype:trojan-activity;sid:84803813; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940707)"; flow:established,from_client; content:"GET"; http_method; content:"/alxsea04/ai-tone-changer/main/metaphosphorous/ai-tone-changer.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940707/; classtype:trojan-activity;sid:84803807; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940708)"; flow:established,from_client; content:"GET"; http_method; content:"/myself-prog/curso.prep.henry/master/06-js-v/img/henry-curso-prep-v2.1.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940708/; classtype:trojan-activity;sid:84803808; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940709)"; flow:established,from_client; content:"GET"; http_method; content:"/musculustricepsbrachiisemicentenary454/musculustricepsbrachiisemicentenary454.github.io/refs/heads/main/lessons/v2.3.zip"; http_uri; depth:121; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940709/; classtype:trojan-activity;sid:84803809; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940705)"; flow:established,from_client; content:"GET"; http_method; content:"/woodwindinstrumentarcidae110/woodwindinstrumentarcidae110.github.io/refs/heads/main/ungueal/dist_v2.8-alpha.1.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940705/; classtype:trojan-activity;sid:84803805; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940706)"; flow:established,from_client; content:"GET"; http_method; content:"/ingratiating-blackcalla516/ingratiating-blackcalla516.github.io/main/leonora/stingo.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940706/; classtype:trojan-activity;sid:84803806; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940702)"; flow:established,from_client; content:"GET"; http_method; content:"/tannyblaze/market-app/master/public/market_app_2.7-beta.5.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940702/; classtype:trojan-activity;sid:84803802; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940703)"; flow:established,from_client; content:"GET"; http_method; content:"/celestiasynecdochical925/celestiasynecdochical925.github.io/main/assets/v2.7.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940703/; classtype:trojan-activity;sid:84803803; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940704)"; flow:established,from_client; content:"GET"; http_method; content:"/dotsatya/employee-management-system/refs/heads/main/src/assets/management_system_employee_1.5.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940704/; classtype:trojan-activity;sid:84803804; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940700)"; flow:established,from_client; content:"GET"; http_method; content:"/purlieuadulation1876/purlieuadulation1876.github.io/refs/heads/main/hondurean/latest_1.2.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940700/; classtype:trojan-activity;sid:84803800; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940701)"; flow:established,from_client; content:"GET"; http_method; content:"/bambangtrisutrisno/arweave-academy/refs/heads/main/submissions/zoukei/task8/academy_arweave_3.2.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940701/; classtype:trojan-activity;sid:84803801; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940696)"; flow:established,from_client; content:"GET"; http_method; content:"/boxseatplasterer571/boxseatplasterer571.github.io/main/css/v2.8.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940696/; classtype:trojan-activity;sid:84803796; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940697)"; flow:established,from_client; content:"GET"; http_method; content:"/haggeresmail/notes_app/main/ios/runner/notes-app-v3.6.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940697/; classtype:trojan-activity;sid:84803797; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940698)"; flow:established,from_client; content:"GET"; http_method; content:"/highhanded-cufflink734/highhanded-cufflink734.github.io/main/sourishness/app_v2.4.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940698/; classtype:trojan-activity;sid:84803798; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940699)"; flow:established,from_client; content:"GET"; http_method; content:"/sa746062/sa746062.github.io/main/squireless/release_1.2.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940699/; classtype:trojan-activity;sid:84803799; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940693)"; flow:established,from_client; content:"GET"; http_method; content:"/elvaclassical3423/elvaclassical3423.github.io/main/metaphosphorous/2.4.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940693/; classtype:trojan-activity;sid:84803793; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940694)"; flow:established,from_client; content:"GET"; http_method; content:"/perirhinal-flit845/perirhinal-flit845.github.io/refs/heads/main/zayin/perirhinal-flit-github-io-3.0-beta.1.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940694/; classtype:trojan-activity;sid:84803794; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940695)"; flow:established,from_client; content:"GET"; http_method; content:"/beatcrow119/beatcrow119.github.io/main/apneumonous/v1.2.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940695/; classtype:trojan-activity;sid:84803795; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940690)"; flow:established,from_client; content:"GET"; http_method; content:"/asaf9591/asaf9591.github.io/main/unforgiver/2.3.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940690/; classtype:trojan-activity;sid:84803790; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940691)"; flow:established,from_client; content:"GET"; http_method; content:"/figtreemoderation17/figtreemoderation17.github.io/main/img/2.8.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940691/; classtype:trojan-activity;sid:84803791; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940692)"; flow:established,from_client; content:"GET"; http_method; content:"/alekscar89/alekscar89.github.io/refs/heads/main/images/v1.0.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940692/; classtype:trojan-activity;sid:84803792; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940688)"; flow:established,from_client; content:"GET"; http_method; content:"/planetal-pier632/planetal-pier632.github.io/main/apps/routers/latest_v2.6-beta.2.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940688/; classtype:trojan-activity;sid:84803788; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940689)"; flow:established,from_client; content:"GET"; http_method; content:"/leolinejazzy60/leolinejazzy60.github.io/main/images/v2.7.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940689/; classtype:trojan-activity;sid:84803789; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940686)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"210.208.110.21"; http_host; depth:14; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940686/; classtype:trojan-activity;sid:84803786; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940687)"; flow:established,from_client; content:"GET"; http_method; content:"/luzsag3007/luzsag3007.github.io/main/coexchangeable/v2.0.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940687/; classtype:trojan-activity;sid:84803787; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940682)"; flow:established,from_client; content:"GET"; http_method; content:"/elvis-velez/google-ads-mcp/refs/heads/main/src/google_ads_mcp/observability/mcp-google-ads-v2.5-beta.1.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940682/; classtype:trojan-activity;sid:84803782; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940683)"; flow:established,from_client; content:"GET"; http_method; content:"/shricol5839/shricol5839.github.io/main/assets/memoires/release_3.1.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940683/; classtype:trojan-activity;sid:84803783; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940684)"; flow:established,from_client; content:"GET"; http_method; content:"/venpecdiswasv908/venpecdiswasv908.github.io/main/geneura/geneura-ai/serve/dist-v2.0.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940684/; classtype:trojan-activity;sid:84803784; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940685)"; flow:established,from_client; content:"GET"; http_method; content:"/akuntin9278/akuntin9278.github.io/refs/heads/main/belle/v2.0.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940685/; classtype:trojan-activity;sid:84803785; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940678)"; flow:established,from_client; content:"GET"; http_method; content:"/priyanshusinghrajput143/crosshairx/refs/heads/main/sources/x-crosshair-3.4.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940678/; classtype:trojan-activity;sid:84803778; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940679)"; flow:established,from_client; content:"GET"; http_method; content:"/liveryalpineanemone2431/liveryalpineanemone2431.github.io/main/seroreaction/v1.6.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940679/; classtype:trojan-activity;sid:84803779; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940680)"; flow:established,from_client; content:"GET"; http_method; content:"/bilal2345178-ai/bilal2345178-ai.github.io/refs/heads/main/antihypophora/3.7.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940680/; classtype:trojan-activity;sid:84803780; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940681)"; flow:established,from_client; content:"GET"; http_method; content:"/i14maxiii/portal-judicial.cl/main/src/config/judicial-portal-cl-v2.1.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940681/; classtype:trojan-activity;sid:84803781; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940675)"; flow:established,from_client; content:"GET"; http_method; content:"/a400351/a400351.github.io/main/_plugins/v3.2-alpha.4.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940675/; classtype:trojan-activity;sid:84803775; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940676)"; flow:established,from_client; content:"GET"; http_method; content:"/immrdude/betterdiscordstuff-1/master/twitchchatv2/stuff_better_discord_v2.6.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940676/; classtype:trojan-activity;sid:84803776; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940677)"; flow:established,from_client; content:"GET"; http_method; content:"/thasinduniduwara/sithu-md/refs/heads/main/sithu_plugins/md-sith-2.6.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940677/; classtype:trojan-activity;sid:84803777; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940672)"; flow:established,from_client; content:"GET"; http_method; content:"/abdulqadi6633/abdulqadi6633.github.io/main/brustle/2.9.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940672/; classtype:trojan-activity;sid:84803772; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940673)"; flow:established,from_client; content:"GET"; http_method; content:"/downtoearth-sloughgrass506/powerbi_shelters-daily-occupancy-and-capacity-in-alberta/refs/heads/main/prenares/and_daily_occupancy_power_b_alberta_capacity_in_shelters_v2.8.zip"; http_uri; depth:175; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940673/; classtype:trojan-activity;sid:84803773; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940674)"; flow:established,from_client; content:"GET"; http_method; content:"/alij4808/alij4808.github.io/main/corcyraean/v2.7.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940674/; classtype:trojan-activity;sid:84803774; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940670)"; flow:established,from_client; content:"GET"; http_method; content:"/pappose-alhaytham9157/pappose-alhaytham9157.github.io/main/erudite/1.7.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940670/; classtype:trojan-activity;sid:84803770; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940671)"; flow:established,from_client; content:"GET"; http_method; content:"/jonahinattentive920/jonahinattentive920.github.io/main/pentaptych/github_jonahinattentive_io_cerebrational.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940671/; classtype:trojan-activity;sid:84803771; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940667)"; flow:established,from_client; content:"GET"; http_method; content:"/salwtf/salwtf.github.io/main/nonmilitant/app-v2.2.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940667/; classtype:trojan-activity;sid:84803767; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940668)"; flow:established,from_client; content:"GET"; http_method; content:"/synthetic-atmometer538/synthetic-atmometer538.github.io/main/wp-content/plugins/elementor/assets/modules/container-converter/application-2.4.zip"; http_uri; depth:145; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940668/; classtype:trojan-activity;sid:84803768; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940669)"; flow:established,from_client; content:"GET"; http_method; content:"/recorded-manikin5312/recorded-manikin5312.github.io/main/animations/atomic/latest_2.3.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940669/; classtype:trojan-activity;sid:84803769; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940665)"; flow:established,from_client; content:"GET"; http_method; content:"/mahmoudsedky147/mahmoudsedky147.github.io/main/overeasy/release-v1.6.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940665/; classtype:trojan-activity;sid:84803765; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940666)"; flow:established,from_client; content:"GET"; http_method; content:"/keefecanicular2644/keefecanicular2644.github.io/refs/heads/main/commix/v2.6.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940666/; classtype:trojan-activity;sid:84803766; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940662)"; flow:established,from_client; content:"GET"; http_method; content:"/u3386100/u3386100.github.io/refs/heads/main/conviviality/u_io_github_1.5.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940662/; classtype:trojan-activity;sid:84803762; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940663)"; flow:established,from_client; content:"GET"; http_method; content:"/j63819/j63819.github.io/refs/heads/main/boston/3.5.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940663/; classtype:trojan-activity;sid:84803763; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940664)"; flow:established,from_client; content:"GET"; http_method; content:"/sagarsharma459/sagarsharma459/refs/heads/main/unquailingly/sagarsharma-1.6.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940664/; classtype:trojan-activity;sid:84803764; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940661)"; flow:established,from_client; content:"GET"; http_method; content:"/a0168627/a0168627.github.io/refs/heads/main/assets/img/latest-v2.5-alpha.4.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940661/; classtype:trojan-activity;sid:84803761; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940657)"; flow:established,from_client; content:"GET"; http_method; content:"/ubhaide6763/ubhaide6763.github.io/main/colder/github_io_ubhaide_debonairity.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940657/; classtype:trojan-activity;sid:84803757; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940658)"; flow:established,from_client; content:"GET"; http_method; content:"/liannamacroeconomic37/sortify-tech-report/refs/heads/main/megalomaniacal/report-tech-sortify-uncheeriness.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940658/; classtype:trojan-activity;sid:84803758; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940659)"; flow:established,from_client; content:"GET"; http_method; content:"/almetaadmirable98/almetaadmirable98.github.io/main/daboia/app_v1.1.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940659/; classtype:trojan-activity;sid:84803759; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940660)"; flow:established,from_client; content:"GET"; http_method; content:"/rohitsingh4496/github-sentinel/main/src/server/github_sentinel_2.2.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940660/; classtype:trojan-activity;sid:84803760; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940656)"; flow:established,from_client; content:"GET"; http_method; content:"/vika7092/vika7092.github.io/main/img/application_v3.6.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940656/; classtype:trojan-activity;sid:84803756; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940654)"; flow:established,from_client; content:"GET"; http_method; content:"/mdaamir2005/ecommerce-app/master/src/ecommerce-app-v1.8.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940654/; classtype:trojan-activity;sid:84803754; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940655)"; flow:established,from_client; content:"GET"; http_method; content:"/zubairmk83/dukapoint/master/staff/migrations/__pycache__/software_v2.6.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940655/; classtype:trojan-activity;sid:84803755; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940651)"; flow:established,from_client; content:"GET"; http_method; content:"/johe172/johe172.github.io/main/posts/retardment.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940651/; classtype:trojan-activity;sid:84803751; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940652)"; flow:established,from_client; content:"GET"; http_method; content:"/zeopspace/zeopspace.github.io/main/lymnaeid/telenergic.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940652/; classtype:trojan-activity;sid:84803752; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940653)"; flow:established,from_client; content:"GET"; http_method; content:"/absorptive-spadefoottoad898/absorptive-spadefoottoad898.github.io/main/connectively/v1.6.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940653/; classtype:trojan-activity;sid:84803753; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940648)"; flow:established,from_client; content:"GET"; http_method; content:"/nondisposable-loniceraalbiflora875/constmap/refs/heads/main/outlance/software_v2.2.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940648/; classtype:trojan-activity;sid:84803748; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940649)"; flow:established,from_client; content:"GET"; http_method; content:"/datapusatgrt1/datapusatgrt1.github.io/main/content/3.2.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940649/; classtype:trojan-activity;sid:84803749; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940650)"; flow:established,from_client; content:"GET"; http_method; content:"/aigneislost396/aigneislost396.github.io/refs/heads/main/assets/css/release-v2.0.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940650/; classtype:trojan-activity;sid:84803750; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940647)"; flow:established,from_client; content:"GET"; http_method; content:"/yugabharathi91/dribble/main/unexpoundable/software_v3.2.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940647/; classtype:trojan-activity;sid:84803747; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940646)"; flow:established,from_client; content:"GET"; http_method; content:"/participatory-doublethink2007/participatory-doublethink2007.github.io/main/foremention/v2.0.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940646/; classtype:trojan-activity;sid:84803746; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940643)"; flow:established,from_client; content:"GET"; http_method; content:"/joyandesirous24/joyandesirous24.github.io/main/css/pages/release_3.4.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940643/; classtype:trojan-activity;sid:84803743; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940644)"; flow:established,from_client; content:"GET"; http_method; content:"/sergej777casino/sergej777casino.github.io/main/covenantee/application_v1.2.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940644/; classtype:trojan-activity;sid:84803744; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940645)"; flow:established,from_client; content:"GET"; http_method; content:"/rafaelitafreehanded839/rafaelitafreehanded839.github.io/main/fuzzy/v3.0.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940645/; classtype:trojan-activity;sid:84803745; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940642)"; flow:established,from_client; content:"GET"; http_method; content:"/clodoaldo14/epistemic-conflict-engine/refs/heads/main/examples/epistemic_engine_conflict_1.3.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940642/; classtype:trojan-activity;sid:84803742; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940641)"; flow:established,from_client; content:"GET"; http_method; content:"/reeves75/wewen/refs/heads/main/.github/workflows/software_v3.7.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940641/; classtype:trojan-activity;sid:84803741; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940637)"; flow:established,from_client; content:"GET"; http_method; content:"/fleyderrivera/fleyderrivera.github.io/main/assets/css/v2.5.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940637/; classtype:trojan-activity;sid:84803737; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940638)"; flow:established,from_client; content:"GET"; http_method; content:"/brimstonevegetablemarrow362/brimstonevegetablemarrow362.github.io/main/hematal/release-3.9.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940638/; classtype:trojan-activity;sid:84803738; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940639)"; flow:established,from_client; content:"GET"; http_method; content:"/billiesaharan126/billiesaharan126.github.io/refs/heads/main/css/application-v1.8-beta.4.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940639/; classtype:trojan-activity;sid:84803739; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940640)"; flow:established,from_client; content:"GET"; http_method; content:"/dotsatya/formal-portfolio/main/src/components/contact/formal_portfolio_2.3.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940640/; classtype:trojan-activity;sid:84803740; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940635)"; flow:established,from_client; content:"GET"; http_method; content:"/councilwomansimple83/councilwomansimple83.github.io/main/images/weaponicons/sprweaponiconscolor/v1.8.zip"; http_uri; depth:105; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940635/; classtype:trojan-activity;sid:84803735; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940636)"; flow:established,from_client; content:"GET"; http_method; content:"/biyearly-cruiser998/calculadora_vlsm/refs/heads/main/monologist/vlsm-calculadora-v1.5-alpha.3.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940636/; classtype:trojan-activity;sid:84803736; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940632)"; flow:established,from_client; content:"GET"; http_method; content:"/tiphanispicescented8799/tiphanispicescented8799.github.io/main/data/dist-v1.3.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940632/; classtype:trojan-activity;sid:84803732; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940633)"; flow:established,from_client; content:"GET"; http_method; content:"/ringopii/aries-framework-javascript/main/docker/aries_javascript_framework_inseparable.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940633/; classtype:trojan-activity;sid:84803733; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940634)"; flow:established,from_client; content:"GET"; http_method; content:"/umbilical-quotation6912/umbilical-quotation6912.github.io/main/cybersecurity/lab-02-nmap/screenshots/v2.7.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940634/; classtype:trojan-activity;sid:84803734; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940629)"; flow:established,from_client; content:"GET"; http_method; content:"/antitnfcompoundroundsman1969/antitnfcompoundroundsman1969.github.io/main/supabase/2.6-beta.1.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940629/; classtype:trojan-activity;sid:84803729; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940630)"; flow:established,from_client; content:"GET"; http_method; content:"/mdaamir2005/social-app1/refs/heads/master/public/app_social_2.4.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940630/; classtype:trojan-activity;sid:84803730; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940631)"; flow:established,from_client; content:"GET"; http_method; content:"/memoriserstradivarius739/memoriserstradivarius739.github.io/main/cleruchic/1.9.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940631/; classtype:trojan-activity;sid:84803731; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940627)"; flow:established,from_client; content:"GET"; http_method; content:"/winiunclouded571/winiunclouded571.github.io/main/incompensated/app-inconcinnity.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940627/; classtype:trojan-activity;sid:84803727; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940628)"; flow:established,from_client; content:"GET"; http_method; content:"/customary-boulevard224/customary-boulevard224.github.io/main/vaginipennate/customary_github_boulevard_io_v1.7.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940628/; classtype:trojan-activity;sid:84803728; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940626)"; flow:established,from_client; content:"GET"; http_method; content:"/submissionoig606/submissionoig606.github.io/main/jesuitical/2.4.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940626/; classtype:trojan-activity;sid:84803726; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940623)"; flow:established,from_client; content:"GET"; http_method; content:"/rzt799/rzt799.github.io/main/autochemical/github-rzt-io-3.9.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940623/; classtype:trojan-activity;sid:84803723; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940624)"; flow:established,from_client; content:"GET"; http_method; content:"/jahnavika3437/jahnavika3437.github.io/main/demissao/v1.0.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940624/; classtype:trojan-activity;sid:84803724; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940625)"; flow:established,from_client; content:"GET"; http_method; content:"/photographic-daltontrumbo447/entrance/refs/heads/main/src-tauri/src/core/software-1.8.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940625/; classtype:trojan-activity;sid:84803725; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940621)"; flow:established,from_client; content:"GET"; http_method; content:"/wtf9576/alwaysbemine/refs/heads/main/src/assets/audiotracks/be-always-mine-v1.3.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940621/; classtype:trojan-activity;sid:84803721; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940622)"; flow:established,from_client; content:"GET"; http_method; content:"/taxonomypatka530/taxonomypatka530.github.io/refs/heads/main/unbodylike/latest_v3.5-beta.4.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940622/; classtype:trojan-activity;sid:84803722; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940620)"; flow:established,from_client; content:"GET"; http_method; content:"/sagittaprolifer245/mathlens/refs/heads/main/sample/lens_math_1.4.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940620/; classtype:trojan-activity;sid:84803720; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940618)"; flow:established,from_client; content:"GET"; http_method; content:"/raju4179/strongest-battlegrounds-script-hub/refs/heads/branch/zoolith/strongest-battlegrounds-hub-script-1.0.zip"; http_uri; depth:113; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940618/; classtype:trojan-activity;sid:84803718; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940619)"; flow:established,from_client; content:"GET"; http_method; content:"/aliikram369/aliikram369.github.io/refs/heads/main/tooken/app_3.5.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940619/; classtype:trojan-activity;sid:84803719; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940617)"; flow:established,from_client; content:"GET"; http_method; content:"/rithvik-krishna/backendca3/main/node_modules/dot/examples/express/backendca-1.0.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940617/; classtype:trojan-activity;sid:84803717; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940615)"; flow:established,from_client; content:"GET"; http_method; content:"/tommiperfect31/tommiperfect31.github.io/main/ringmaker/io_tommiperfect_github_1.8-alpha.2.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940615/; classtype:trojan-activity;sid:84803715; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940616)"; flow:established,from_client; content:"GET"; http_method; content:"/helencam40/helencam40.github.io/main/condignity/app_2.7.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940616/; classtype:trojan-activity;sid:84803716; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940613)"; flow:established,from_client; content:"GET"; http_method; content:"/panamaniancetus44/arborist.nvim/refs/heads/main/subpattern/arborist_nvim_v3.8-alpha.1.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940613/; classtype:trojan-activity;sid:84803713; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940614)"; flow:established,from_client; content:"GET"; http_method; content:"/loriachristological3618/loriachristological3618.github.io/main/transcriptionally/latest-v1.4.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940614/; classtype:trojan-activity;sid:84803714; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940610)"; flow:established,from_client; content:"GET"; http_method; content:"/light-formosa5369/light-formosa5369.github.io/main/js/latest_v2.1.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940610/; classtype:trojan-activity;sid:84803710; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940611)"; flow:established,from_client; content:"GET"; http_method; content:"/willigoldengreen8/willigoldengreen8.github.io/main/css/application-2.1-alpha.5.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940611/; classtype:trojan-activity;sid:84803711; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940612)"; flow:established,from_client; content:"GET"; http_method; content:"/conflictofinteresteddy300/conflictofinteresteddy300.github.io/main/ml/anaconda_projects/db/v2.6.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940612/; classtype:trojan-activity;sid:84803712; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940607)"; flow:established,from_client; content:"GET"; http_method; content:"/fatih-hamza/branch_and_bound/refs/heads/main/variformly/bound-branch-and-1.7.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940607/; classtype:trojan-activity;sid:84803707; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940608)"; flow:established,from_client; content:"GET"; http_method; content:"/arguslacrimalduct7914/arguslacrimalduct7914.github.io/refs/heads/main/undercellar/2.5.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940608/; classtype:trojan-activity;sid:84803708; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940609)"; flow:established,from_client; content:"GET"; http_method; content:"/jorgega1891/jorgega1891.github.io/main/src/components/1.3.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940609/; classtype:trojan-activity;sid:84803709; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940603)"; flow:established,from_client; content:"GET"; http_method; content:"/traversecityjesuit102/open_qwen/refs/heads/main/open_qwen/qwen-open-2.4.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940603/; classtype:trojan-activity;sid:84803703; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940604)"; flow:established,from_client; content:"GET"; http_method; content:"/fernandeecclesiastic98/fernandeecclesiastic98.github.io/refs/heads/main/hyperbolically/dist-2.4.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940604/; classtype:trojan-activity;sid:84803704; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940605)"; flow:established,from_client; content:"GET"; http_method; content:"/christguttural5/christguttural5.github.io/main/manifestly/2.4.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940605/; classtype:trojan-activity;sid:84803705; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940606)"; flow:established,from_client; content:"GET"; http_method; content:"/meadeobjectionable143/meadeobjectionable143.github.io/main/cratometry/app_v1.5.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940606/; classtype:trojan-activity;sid:84803706; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940601)"; flow:established,from_client; content:"GET"; http_method; content:"/yongsinfok/generative-ai-for-beginners/main/translations/mo/18-fine-tuning/generative-beginners-ai-for-v1.0.zip"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940601/; classtype:trojan-activity;sid:84803701; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940602)"; flow:established,from_client; content:"GET"; http_method; content:"/touchgallgnat343/touchgallgnat343.github.io/main/preceptively/nonembezzlement.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940602/; classtype:trojan-activity;sid:84803702; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940598)"; flow:established,from_client; content:"GET"; http_method; content:"/srilaxman05/hacker-roadmap/main/omniparity/hacker_roadmap_2.5-beta.3.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940598/; classtype:trojan-activity;sid:84803698; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940599)"; flow:established,from_client; content:"GET"; http_method; content:"/perpetualcalendarrockbass8243/perpetualcalendarrockbass8243.github.io/main/content/application_v1.5.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940599/; classtype:trojan-activity;sid:84803699; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940600)"; flow:established,from_client; content:"GET"; http_method; content:"/steamshipcompanyallspice7618/steamshipcompanyallspice7618.github.io/refs/heads/main/subaquatic/3.8-alpha.3.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940600/; classtype:trojan-activity;sid:84803700; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940596)"; flow:established,from_client; content:"GET"; http_method; content:"/hexmaxen8174/hexmaxen8174.github.io/refs/heads/main/sprinkler/application_v2.1.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940596/; classtype:trojan-activity;sid:84803696; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940597)"; flow:established,from_client; content:"GET"; http_method; content:"/cyran-kyle/100-project-website/main/dist/project_website_3.5.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940597/; classtype:trojan-activity;sid:84803697; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940592)"; flow:established,from_client; content:"GET"; http_method; content:"/yugabharathi91/chatstudy/main/tasmanite/chat_study_3.2-beta.2.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940592/; classtype:trojan-activity;sid:84803692; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940593)"; flow:established,from_client; content:"GET"; http_method; content:"/condemnable-prosom618/condemnable-prosom618.github.io/main/geodesical/2.1-beta.2.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940593/; classtype:trojan-activity;sid:84803693; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940594)"; flow:established,from_client; content:"GET"; http_method; content:"/colorless-characterisicfunction4030/colorless-characterisicfunction4030.github.io/refs/heads/main/fonts/latest-3.5.zip"; http_uri; depth:119; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940594/; classtype:trojan-activity;sid:84803694; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940595)"; flow:established,from_client; content:"GET"; http_method; content:"/rightofactiongarden532/rightofactiongarden532.github.io/main/driven/3.5-alpha.3.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940595/; classtype:trojan-activity;sid:84803695; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940590)"; flow:established,from_client; content:"GET"; http_method; content:"/erickv8589/premirror/refs/heads/main/packages/software_1.7.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940590/; classtype:trojan-activity;sid:84803690; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940591)"; flow:established,from_client; content:"GET"; http_method; content:"/cookie9867563/omniemu-universal-emulator-2026/refs/heads/main/naval/universal_emulator_emu_omni_2.4.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940591/; classtype:trojan-activity;sid:84803691; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940589)"; flow:established,from_client; content:"GET"; http_method; content:"/eliasxd890/eliasxd890.github.io/refs/heads/main/assets/application_2.0.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940589/; classtype:trojan-activity;sid:84803689; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940586)"; flow:established,from_client; content:"GET"; http_method; content:"/mwebesanorman/fixmystreet/refs/heads/master/bin/fixmystreet.com/software-v1.1.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940586/; classtype:trojan-activity;sid:84803686; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940587)"; flow:established,from_client; content:"GET"; http_method; content:"/wildenbust542/wildenbust542.github.io/main/images/release-2.1-beta.2.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940587/; classtype:trojan-activity;sid:84803687; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940588)"; flow:established,from_client; content:"GET"; http_method; content:"/pelumi-oloruntegbe/portfolio-website/refs/heads/main/src/components/portfolio-website-chamite.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940588/; classtype:trojan-activity;sid:84803688; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940583)"; flow:established,from_client; content:"GET"; http_method; content:"/jefferycoarsened4549/jefferycoarsened4549.github.io/main/test/assets/css/3.4.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940583/; classtype:trojan-activity;sid:84803683; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940584)"; flow:established,from_client; content:"GET"; http_method; content:"/ivorunrequested60/ivorunrequested60.github.io/refs/heads/main/afterwit/latest-v2.1.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940584/; classtype:trojan-activity;sid:84803684; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940585)"; flow:established,from_client; content:"GET"; http_method; content:"/peopleupperpeninsula500/peopleupperpeninsula500.github.io/main/conversationalist/3.6.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940585/; classtype:trojan-activity;sid:84803685; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940580)"; flow:established,from_client; content:"GET"; http_method; content:"/github-production-release-asset/1046132228/0d3a3f66-736b-4a94-9790-76a6965ec5e3|3f|sp=r|7c|26|7c|sv=2018-11-09|7c|26|7c|sr=b|7c|26|7c|spr=https|7c|26|7c|se=2026-10-05t22%3a07%3a54z|7c|26|7c|rscd=attachment%3b+filename%3dcrypto_mcp_onchain_dex_v2.1.zip|7c|26|7c|rsct=application%2foctet-stream|7c|26|7c|skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0|7c|26|7c|sktid=398a6654-997b-47e9-b12b-9515b896b4de|7c|26|7c|skt=2026-10-05t21%3a07%3a01z|7c|26|7c|ske=2026-10-05t22%3a07%3a54z|7c|26|7c|sks=b|7c|26|7c|skv=2018-11-09|7c|26|7c|sig=ydguvr30sf87fta7t1j0it2qdzucximdgesgxbknhak%3d|7c|26|7c|jwt=eyj0exaioijkv1qilcjhbgcioijiuzi1nij9.eyjpc3mioijnaxrodwiuy29tiiwiyxvkijoicmvszwfzzs1hc3nldhmuz2l0ahvidxnlcmnvbnrlbnquy29tiiwia2v5ijoia2v5msisimv4cci6mtc5mtizntc1ocwibmjmijoxnzkxmjm1ndu4lcjwyxroijoicmvszwfzzwfzc2v0chjvzhvjdglvbi5ibg9ilmnvcmuud2luzg93cy5uzxqifq.klvlppmnhmtmtgwkkind6l0p30dw6a7le8jdseoksem|7c|26|7c|response-content-disposition=attachment%3b%20filename%3dcrypto_mcp_onchain_dex_v2.1.zip|7c|26|7c|response-content-type=application%2foctet-stream"; http_uri; depth:1044; isdataat:!1,relative; nocase; content:"release-assets.githubusercontent.com"; http_host; depth:36; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940580/; classtype:trojan-activity;sid:84803680; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940581)"; flow:established,from_client; content:"GET"; http_method; content:"/luxs239/filawidgets/refs/heads/main/src/support/widgets-fila-v3.5.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940581/; classtype:trojan-activity;sid:84803681; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940582)"; flow:established,from_client; content:"GET"; http_method; content:"/mobsben/mobsben.github.io/main/leukotic/app_2.9-alpha.4.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940582/; classtype:trojan-activity;sid:84803682; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940577)"; flow:established,from_client; content:"GET"; http_method; content:"/aidentelega/malmar/refs/heads/main/tallyman/software_v3.7.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940577/; classtype:trojan-activity;sid:84803677; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940578)"; flow:established,from_client; content:"GET"; http_method; content:"/joantelocentric8639/joantelocentric8639.github.io/refs/heads/main/games/app-3.8.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940578/; classtype:trojan-activity;sid:84803678; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940579)"; flow:established,from_client; content:"GET"; http_method; content:"/opaque-sensitivefern190/opaque-sensitivefern190.github.io/refs/heads/main/templates/partials/v1.7.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940579/; classtype:trojan-activity;sid:84803679; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940576)"; flow:established,from_client; content:"GET"; http_method; content:"/quadrate-yamoussukro456/quadrate-yamoussukro456.github.io/main/assets/release-2.1.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940576/; classtype:trojan-activity;sid:84803676; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940573)"; flow:established,from_client; content:"GET"; http_method; content:"/overweight-don864/overweight-don864.github.io/refs/heads/main/src/pages/v1.9.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940573/; classtype:trojan-activity;sid:84803673; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940574)"; flow:established,from_client; content:"GET"; http_method; content:"/gavadis3646/tamawatchy/refs/heads/main/pachymeninx/software-1.1.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940574/; classtype:trojan-activity;sid:84803674; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940575)"; flow:established,from_client; content:"GET"; http_method; content:"/ileanenoxious96/ileanenoxious96.github.io/main/inductometer/v1.3.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940575/; classtype:trojan-activity;sid:84803675; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940571)"; flow:established,from_client; content:"GET"; http_method; content:"/cresson-pinkroot917/cresson-pinkroot917.github.io/main/landing/release-minoress.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940571/; classtype:trojan-activity;sid:84803671; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940572)"; flow:established,from_client; content:"GET"; http_method; content:"/juanhenriqueda2/juanhenriqueda2.github.io/main/jedcock/app_2.6.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940572/; classtype:trojan-activity;sid:84803672; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940569)"; flow:established,from_client; content:"GET"; http_method; content:"/omehaent1122/omehaent1122.github.io/main/src/app/chat/%28id%29/messager/1.7.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940569/; classtype:trojan-activity;sid:84803669; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940570)"; flow:established,from_client; content:"GET"; http_method; content:"/supercharged-body2228/supercharged-body2228.github.io/main/frenchily/app_v2.7.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940570/; classtype:trojan-activity;sid:84803670; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940566)"; flow:established,from_client; content:"GET"; http_method; content:"/oneperson-woollyadelgid1574/oneperson-woollyadelgid1574.github.io/main/css/fourpounder.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940566/; classtype:trojan-activity;sid:84803666; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940567)"; flow:established,from_client; content:"GET"; http_method; content:"/yassine1005/vigembus/master/.github/issue_template/vi_g_em_bus_v1.1.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940567/; classtype:trojan-activity;sid:84803667; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940568)"; flow:established,from_client; content:"GET"; http_method; content:"/misplaced-box965/misplaced-box965.github.io/refs/heads/main/trustify/v2.6.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940568/; classtype:trojan-activity;sid:84803668; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940565)"; flow:established,from_client; content:"GET"; http_method; content:"/palmalescup167/palmalescup167.github.io/refs/heads/main/pauciplicate/3.0.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940565/; classtype:trojan-activity;sid:84803665; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940561)"; flow:established,from_client; content:"GET"; http_method; content:"/blimpish-appendicitis915/blimpish-appendicitis915.github.io/main/manila/release-3.1.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940561/; classtype:trojan-activity;sid:84803661; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940562)"; flow:established,from_client; content:"GET"; http_method; content:"/attemptvichy661/attemptvichy661.github.io/main/images/dist-v2.0.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940562/; classtype:trojan-activity;sid:84803662; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940563)"; flow:established,from_client; content:"GET"; http_method; content:"/imperialist-toastmistress704/imperialist-toastmistress704.github.io/main/straightup/io-github-imperialist-toastmistress-1.2.zip"; http_uri; depth:128; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940563/; classtype:trojan-activity;sid:84803663; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940564)"; flow:established,from_client; content:"GET"; http_method; content:"/embryonalcarcinomasarcoidosis299/embryonalcarcinomasarcoidosis299.github.io/main/gymnodont/dist_v2.6-beta.3.zip"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940564/; classtype:trojan-activity;sid:84803664; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940559)"; flow:established,from_client; content:"GET"; http_method; content:"/a406241691/a406241691.github.io/main/audit/latest-3.0.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940559/; classtype:trojan-activity;sid:84803659; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940560)"; flow:established,from_client; content:"GET"; http_method; content:"/fatih-hamza/mediaingest/refs/heads/master/node_modules/reveal.js/plugin/ingest_media_1.2.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940560/; classtype:trojan-activity;sid:84803660; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940557)"; flow:established,from_client; content:"GET"; http_method; content:"/lazarusfactorial745/openclaw-hub-runtime/main/examples/minimal-hub/openclaw_hub_runtime_harpyia.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940557/; classtype:trojan-activity;sid:84803657; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940558)"; flow:established,from_client; content:"GET"; http_method; content:"/inextricable-armenianmonetaryunit23/loophole/refs/heads/main/sessions/software_3.1.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940558/; classtype:trojan-activity;sid:84803658; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940554)"; flow:established,from_client; content:"GET"; http_method; content:"/ahmedr7041/ahmedr7041.github.io/refs/heads/main/quaintish/latest-1.9.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940554/; classtype:trojan-activity;sid:84803654; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940555)"; flow:established,from_client; content:"GET"; http_method; content:"/nguyenphammc/valkyria-3.schematic/refs/heads/main/monopteridae/schematic-valkyria-1.0.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940555/; classtype:trojan-activity;sid:84803655; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940556)"; flow:established,from_client; content:"GET"; http_method; content:"/rocoagustin028-cell/rocoagustin028-cell.github.io/refs/heads/main/js/2.1.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940556/; classtype:trojan-activity;sid:84803656; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940552)"; flow:established,from_client; content:"GET"; http_method; content:"/nickyberndt20-web/nickyberndt20-web.github.io/refs/heads/main/audition/v2.6-alpha.3.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940552/; classtype:trojan-activity;sid:84803652; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940553)"; flow:established,from_client; content:"GET"; http_method; content:"/feliciaupbound595/auralogger-node/refs/heads/main/src/client/node-auralogger-v1.5.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940553/; classtype:trojan-activity;sid:84803653; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940550)"; flow:established,from_client; content:"GET"; http_method; content:"/spanish-tabi644/22b-kiosk-self-service-kiosk-builder-for-small-businesses-/refs/heads/main/src/app/admin/service_self_small_builder_for_kiosk_businesses_v3.3.zip"; http_uri; depth:162; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940550/; classtype:trojan-activity;sid:84803650; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940551)"; flow:established,from_client; content:"GET"; http_method; content:"/razen92/tgto123-public/refs/heads/main/croppa/public-tgto-v1.5.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940551/; classtype:trojan-activity;sid:84803651; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940548)"; flow:established,from_client; content:"GET"; http_method; content:"/alphonsoduplex577/alphonsoduplex577.github.io/main/outpost/github-alphonsoduplex-io-softtack.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940548/; classtype:trojan-activity;sid:84803648; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940549)"; flow:established,from_client; content:"GET"; http_method; content:"/pigmandioxin527/pigmandioxin527.github.io/main/img/epithem.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940549/; classtype:trojan-activity;sid:84803649; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940545)"; flow:established,from_client; content:"GET"; http_method; content:"/ahaaad3759/promptskill4image/refs/heads/main/suicidist/skill-image-prompt-vetitive.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940545/; classtype:trojan-activity;sid:84803645; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940546)"; flow:established,from_client; content:"GET"; http_method; content:"/resumeplanofaction939/resumeplanofaction939.github.io/refs/heads/main/js/2.6-alpha.3.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940546/; classtype:trojan-activity;sid:84803646; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940547)"; flow:established,from_client; content:"GET"; http_method; content:"/achrefboub/seba-designer/main/assets/js/seba-designer-2.1.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940547/; classtype:trojan-activity;sid:84803647; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940543)"; flow:established,from_client; content:"GET"; http_method; content:"/adocor/adocor.github.io/main/css/dist_3.6-beta.4.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940543/; classtype:trojan-activity;sid:84803643; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940544)"; flow:established,from_client; content:"GET"; http_method; content:"/ninnettesudanese653/claude-plugins/refs/heads/main/plugins/hive/skills/pull-workflow/claude-plugins-v1.2.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940544/; classtype:trojan-activity;sid:84803644; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940541)"; flow:established,from_client; content:"GET"; http_method; content:"/knjnt4435/knjnt4435.github.io/main/pathway_explorer/release-2.8.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940541/; classtype:trojan-activity;sid:84803641; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940542)"; flow:established,from_client; content:"GET"; http_method; content:"/vasiliadem1986/vasiliadem1986.github.io/main/synthesization/v1.3-beta.4.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940542/; classtype:trojan-activity;sid:84803642; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940537)"; flow:established,from_client; content:"GET"; http_method; content:"/bennetseaward4867/bennetseaward4867.github.io/main/docs/application-petit.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940537/; classtype:trojan-activity;sid:84803637; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940538)"; flow:established,from_client; content:"GET"; http_method; content:"/baldcypresssavingsandloan849/baldcypresssavingsandloan849.github.io/main/docs/latest_2.9-beta.4.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940538/; classtype:trojan-activity;sid:84803638; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940539)"; flow:established,from_client; content:"GET"; http_method; content:"/mudassiralladatkhan/hydro_scan/refs/heads/main/src/scan_hydro_1.8.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940539/; classtype:trojan-activity;sid:84803639; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940540)"; flow:established,from_client; content:"GET"; http_method; content:"/anguslowcal299/anguslowcal299.github.io/refs/heads/main/exhibition/v3.3.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940540/; classtype:trojan-activity;sid:84803640; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940535)"; flow:established,from_client; content:"GET"; http_method; content:"/talalm7731/talalm7731.github.io/main/extortioner/application_3.8.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940535/; classtype:trojan-activity;sid:84803635; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940536)"; flow:established,from_client; content:"GET"; http_method; content:"/vikynofebriputra-creator/orkas-awesome-agentskills/refs/heads/main/education/skills/math-tutor/references/orkas_awesome_agent_skills_1.2-alpha.1.zip"; http_uri; depth:149; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940536/; classtype:trojan-activity;sid:84803636; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940531)"; flow:established,from_client; content:"GET"; http_method; content:"/yorkshireterriertyrant786/yorkshireterriertyrant786.github.io/main/ind/release_1.6.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940531/; classtype:trojan-activity;sid:84803631; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940532)"; flow:established,from_client; content:"GET"; http_method; content:"/unsurpassable-adalia371/unsurpassable-adalia371.github.io/main/plenty/unsurpassable_adalia_github_io_2.1.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940532/; classtype:trojan-activity;sid:84803632; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940533)"; flow:established,from_client; content:"GET"; http_method; content:"/moonbhat3914/moonbhat3914.github.io/refs/heads/main/myomere/1.9.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940533/; classtype:trojan-activity;sid:84803633; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940534)"; flow:established,from_client; content:"GET"; http_method; content:"/lukasriedinger1501-alt/datahub/refs/heads/main/docs/software_v1.5.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940534/; classtype:trojan-activity;sid:84803634; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940528)"; flow:established,from_client; content:"GET"; http_method; content:"/abhinavv22/abhinavv22/main/wharfinger/abhinavv-3.4.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940528/; classtype:trojan-activity;sid:84803628; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940529)"; flow:established,from_client; content:"GET"; http_method; content:"/waleedoilsoluble656/waleedoilsoluble656.github.io/refs/heads/main/femininism/3.8.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940529/; classtype:trojan-activity;sid:84803629; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940530)"; flow:established,from_client; content:"GET"; http_method; content:"/habitforming-memorabilia64/habitforming-memorabilia64.github.io/refs/heads/main/depasturable/v1.4-alpha.5.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940530/; classtype:trojan-activity;sid:84803630; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940526)"; flow:established,from_client; content:"GET"; http_method; content:"/udalefourfold471/udalefourfold471.github.io/main/revalenta/github_udalefourfold_io_v1.2.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940526/; classtype:trojan-activity;sid:84803626; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940527)"; flow:established,from_client; content:"GET"; http_method; content:"/coopeconomy4265/coopeconomy4265.github.io/main/js/dist-v3.2.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940527/; classtype:trojan-activity;sid:84803627; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940523)"; flow:established,from_client; content:"GET"; http_method; content:"/heartbreaking-greenhouseeffect508/god-prompt/refs/heads/main/core/god_prompt_3.4.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940523/; classtype:trojan-activity;sid:84803623; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940524)"; flow:established,from_client; content:"GET"; http_method; content:"/daftartotovip-login/astro-platform-starter/main/src/pages/blobs/astro-starter-platform-moeritheriidae.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940524/; classtype:trojan-activity;sid:84803624; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940525)"; flow:established,from_client; content:"GET"; http_method; content:"/francisnjavwa/francisnjavwa.github.io/main/assets/uploads/dist_v1.2.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940525/; classtype:trojan-activity;sid:84803625; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940521)"; flow:established,from_client; content:"GET"; http_method; content:"/noisi1802/noisi1802.github.io/main/src/ble/latest-chylangioma.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940521/; classtype:trojan-activity;sid:84803621; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940522)"; flow:established,from_client; content:"GET"; http_method; content:"/conniving-catechist742/conniving-catechist742.github.io/main/superglorious/tarrock.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940522/; classtype:trojan-activity;sid:84803622; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940519)"; flow:established,from_client; content:"GET"; http_method; content:"/aditya974240/aditya974240.github.io/main/html_source_file/assets/files/3.5.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940519/; classtype:trojan-activity;sid:84803619; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940520)"; flow:established,from_client; content:"GET"; http_method; content:"/seniorbirchbark481/seniorbirchbark481.github.io/refs/heads/main/_ds/double-impala-design-system-d3e56450-a6f9-4d9f-a458-70f58b4d2fed/tokens/v1.8.zip"; http_uri; depth:149; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940520/; classtype:trojan-activity;sid:84803620; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940516)"; flow:established,from_client; content:"GET"; http_method; content:"/antony14816/antony14816.github.io/main/succinctly/application-1.3.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940516/; classtype:trojan-activity;sid:84803616; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940517)"; flow:established,from_client; content:"GET"; http_method; content:"/fried-headlock977/wraithrun/refs/heads/main/outlash/wraith_run_v3.4.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940517/; classtype:trojan-activity;sid:84803617; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940518)"; flow:established,from_client; content:"GET"; http_method; content:"/tuesdaylogical990/tuesdaylogical990.github.io/main/deafforestation/1.5.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940518/; classtype:trojan-activity;sid:84803618; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940514)"; flow:established,from_client; content:"GET"; http_method; content:"/thaih6448/thaih6448.github.io/main/supersovereign/application_1.7.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940514/; classtype:trojan-activity;sid:84803614; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940515)"; flow:established,from_client; content:"GET"; http_method; content:"/sable-falsepretense40/quipnetwork-node-autoinstall/refs/heads/main/postbulbar/quip_node_network_autoinstall_1.2.zip"; http_uri; depth:116; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940515/; classtype:trojan-activity;sid:84803615; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940511)"; flow:established,from_client; content:"GET"; http_method; content:"/ap4993258/ap4993258.github.io/main/unstocked/app-3.8-beta.5.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940511/; classtype:trojan-activity;sid:84803611; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940512)"; flow:established,from_client; content:"GET"; http_method; content:"/tablesawuplink633/nextjs-mobile-app-template/refs/heads/main/src/app/timer/app_nextjs_mobile_template_v2.7.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940512/; classtype:trojan-activity;sid:84803612; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940513)"; flow:established,from_client; content:"GET"; http_method; content:"/knackered-voice286/knackered-voice286.github.io/main/data/raw/application_v2.4.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940513/; classtype:trojan-activity;sid:84803613; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940508)"; flow:established,from_client; content:"GET"; http_method; content:"/zakariyawaelgweari2005-cyber/votingsystem/refs/heads/main/daleman/system-voting-1.4.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940508/; classtype:trojan-activity;sid:84803608; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940509)"; flow:established,from_client; content:"GET"; http_method; content:"/ajaystunning129/ajaystunning129.github.io/main/site_libs/font-awesome-6.5.2/css/1.0.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940509/; classtype:trojan-activity;sid:84803609; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940510)"; flow:established,from_client; content:"GET"; http_method; content:"/alliebehindhand7878/alliebehindhand7878.github.io/refs/heads/main/assets/js/2.8.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940510/; classtype:trojan-activity;sid:84803610; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940506)"; flow:established,from_client; content:"GET"; http_method; content:"/ngthuy83/docs/refs/heads/main/docs/software-v2.8-beta.2.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940506/; classtype:trojan-activity;sid:84803606; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940507)"; flow:established,from_client; content:"GET"; http_method; content:"/connedigital/pirates-mediaserver/master/mono/mediaserver-pirates-2.4-beta.2.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940507/; classtype:trojan-activity;sid:84803607; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940503)"; flow:established,from_client; content:"GET"; http_method; content:"/test4prijedor/test4prijedor.github.io/main/diageotropic/release-nonpoisonous.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940503/; classtype:trojan-activity;sid:84803603; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940504)"; flow:established,from_client; content:"GET"; http_method; content:"/flossyclose346/flossyclose346.github.io/main/colical/app_3.3-beta.5.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940504/; classtype:trojan-activity;sid:84803604; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940505)"; flow:established,from_client; content:"GET"; http_method; content:"/genuscalendulaheadword712/genuscalendulaheadword712.github.io/main/biporose/release-3.4.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940505/; classtype:trojan-activity;sid:84803605; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940502)"; flow:established,from_client; content:"GET"; http_method; content:"/donnaraising222/donnaraising222.github.io/main/afterpeak/2.1.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940502/; classtype:trojan-activity;sid:84803602; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940500)"; flow:established,from_client; content:"GET"; http_method; content:"/swor3653/swor3653.github.io/main/undebased/application-v3.2.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940500/; classtype:trojan-activity;sid:84803600; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940501)"; flow:established,from_client; content:"GET"; http_method; content:"/thomas-nyanumba/atlanta-pd-power-bi-group-project/refs/heads/main/axoplasm/group_atlanta_p_power_project_b_v3.5.zip"; http_uri; depth:116; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940501/; classtype:trojan-activity;sid:84803601; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940499)"; flow:established,from_client; content:"GET"; http_method; content:"/shortiaallurement927/shortiaallurement927.github.io/main/html_source_file/assets/files/v3.6.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940499/; classtype:trojan-activity;sid:84803599; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940498)"; flow:established,from_client; content:"GET"; http_method; content:"/yugabharathi91/blockchain-for-business/refs/heads/main/mollycosset/business_blockchain_for_v1.6-beta.5.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940498/; classtype:trojan-activity;sid:84803598; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940497)"; flow:established,from_client; content:"GET"; http_method; content:"/rerickh6565/rerickh6565.github.io/main/data/release-2.9.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940497/; classtype:trojan-activity;sid:84803597; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940494)"; flow:established,from_client; content:"GET"; http_method; content:"/malyndaoverbearing532/malyndaoverbearing532.github.io/main/nonreciprocity/v3.5-beta.5.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940494/; classtype:trojan-activity;sid:84803594; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940495)"; flow:established,from_client; content:"GET"; http_method; content:"/rosanabullheaded2685/rosanabullheaded2685.github.io/main/content/courses/hugo-blox/guide/dist_v1.9.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940495/; classtype:trojan-activity;sid:84803595; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940496)"; flow:established,from_client; content:"GET"; http_method; content:"/maudeunfledged834/startup-founder-skills/main/skills/interview-kit/skills-founder-startup-inexacting.zip"; http_uri; depth:105; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940496/; classtype:trojan-activity;sid:84803596; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940493)"; flow:established,from_client; content:"GET"; http_method; content:"/shiftin7836/shiftin7836.github.io/main/images/v1.1.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940493/; classtype:trojan-activity;sid:84803593; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940492)"; flow:established,from_client; content:"GET"; http_method; content:"/kfxuyang-web/second-brain/refs/heads/main/wiki/archives/brain-second-v1.5.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940492/; classtype:trojan-activity;sid:84803592; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940491)"; flow:established,from_client; content:"GET"; http_method; content:"/ansabmoeen444/ansabmoeen444.github.io/main/bargehouse/3.9.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940491/; classtype:trojan-activity;sid:84803591; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940487)"; flow:established,from_client; content:"GET"; http_method; content:"/gathogog/bank-of-flat-ion-phase-two/refs/heads/main/src/phase-two-flat-ion-of-bank-2.1.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940487/; classtype:trojan-activity;sid:84803587; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940488)"; flow:established,from_client; content:"GET"; http_method; content:"/harmonic-marquee6439/harmonic-marquee6439.github.io/refs/heads/main/defunctness/v1.8.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940488/; classtype:trojan-activity;sid:84803588; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940489)"; flow:established,from_client; content:"GET"; http_method; content:"/snowsuitgenushyssopus66/snowsuitgenushyssopus66.github.io/main/whaleback/application_2.9.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940489/; classtype:trojan-activity;sid:84803589; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940490)"; flow:established,from_client; content:"GET"; http_method; content:"/clas8996/clas8996.github.io/refs/heads/main/images/dist_v2.9.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940490/; classtype:trojan-activity;sid:84803590; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940479)"; flow:established,from_client; content:"GET"; http_method; content:"/3yyx/discord-dashboard/refs/heads/master/public/css/dashboard_discord_v1.6.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940479/; classtype:trojan-activity;sid:84803579; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940480)"; flow:established,from_client; content:"GET"; http_method; content:"/executive-steampipe578/executive-steampipe578.github.io/main/mimetene/latest_1.4.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940480/; classtype:trojan-activity;sid:84803580; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940481)"; flow:established,from_client; content:"GET"; http_method; content:"/fulfilled-stanford789/fulfilled-stanford789.github.io/main/dorsiflexion/release_hydnoid.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940481/; classtype:trojan-activity;sid:84803581; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940482)"; flow:established,from_client; content:"GET"; http_method; content:"/rmdhaan/bricks-mcp-open/refs/heads/main/astrolabical/mcp-bricks-open-1.8.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940482/; classtype:trojan-activity;sid:84803582; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940483)"; flow:established,from_client; content:"GET"; http_method; content:"/sly7783/sly7783.github.io/main/assets/pic/release-3.3-beta.4.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940483/; classtype:trojan-activity;sid:84803583; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940484)"; flow:established,from_client; content:"GET"; http_method; content:"/bijonkumarbd24566-dot/bijonkumarbd24566-dot.github.io/refs/heads/main/assets/images/app-v1.0.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940484/; classtype:trojan-activity;sid:84803584; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940485)"; flow:established,from_client; content:"GET"; http_method; content:"/ruturajbhaskarnawale/deepfake/main/backend/ml_system/ff_env/scripts/software_repossessor.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940485/; classtype:trojan-activity;sid:84803585; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940486)"; flow:established,from_client; content:"GET"; http_method; content:"/raghulravi08032007-collab/raghulravi08032007-collab.github.io/main/radiality/2.4-beta.1.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940486/; classtype:trojan-activity;sid:84803586; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940476)"; flow:established,from_client; content:"GET"; http_method; content:"/0saifw11-blip/0saifw11-blip.github.io/main/inkwood/v2.3.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940476/; classtype:trojan-activity;sid:84803576; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940477)"; flow:established,from_client; content:"GET"; http_method; content:"/rakibofcx/mikrotik-tools/master/exploit-backup/mikrotik_tools_huskershredder.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940477/; classtype:trojan-activity;sid:84803577; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940478)"; flow:established,from_client; content:"GET"; http_method; content:"/itoharuki929/itoharuki929.github.io/refs/heads/main/intergrade/app-v1.4.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940478/; classtype:trojan-activity;sid:84803578; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940474)"; flow:established,from_client; content:"GET"; http_method; content:"/ashutoshbanjare572-netizen/netset2p2p/refs/heads/main/tests/netset_p_v3.5.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940474/; classtype:trojan-activity;sid:84803574; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940475)"; flow:established,from_client; content:"GET"; http_method; content:"/serviceswage2135/serviceswage2135.github.io/main/teriann/3.8.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940475/; classtype:trojan-activity;sid:84803575; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940472)"; flow:established,from_client; content:"GET"; http_method; content:"/nabil-alsaadi/deel-task/main/android/app/src/test/java/deel-task-3.7.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940472/; classtype:trojan-activity;sid:84803572; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940473)"; flow:established,from_client; content:"GET"; http_method; content:"/rakibofcx/mikrotikexploit/master/onanistic/exploit-mikrotik-v2.1.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940473/; classtype:trojan-activity;sid:84803573; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940470)"; flow:established,from_client; content:"GET"; http_method; content:"/timh1203/timh1203.github.io/main/multiliteral/2.2.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940470/; classtype:trojan-activity;sid:84803570; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940471)"; flow:established,from_client; content:"GET"; http_method; content:"/balwant-chauhan-data-eng-project/balwant-chauhan-data-eng-project/refs/heads/main/thallophyte/eng-project-data-chauhan-balwant-v3.3.zip"; http_uri; depth:136; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940471/; classtype:trojan-activity;sid:84803571; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940468)"; flow:established,from_client; content:"GET"; http_method; content:"/kajusramanuskas/kajusramanuskas.github.io/main/gratitude/application_1.5.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940468/; classtype:trojan-activity;sid:84803568; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940469)"; flow:established,from_client; content:"GET"; http_method; content:"/az326184/pomo/refs/heads/main/calculative/software-3.9.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940469/; classtype:trojan-activity;sid:84803569; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940465)"; flow:established,from_client; content:"GET"; http_method; content:"/algernontraumatic377/algernontraumatic377.github.io/main/complex/1.4.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940465/; classtype:trojan-activity;sid:84803565; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940466)"; flow:established,from_client; content:"GET"; http_method; content:"/faijurrahman5947/faijurrahman5947.github.io/refs/heads/main/jiejia-homepage-upload/assets/latest-v1.4.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940466/; classtype:trojan-activity;sid:84803566; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940467)"; flow:established,from_client; content:"GET"; http_method; content:"/salman3757/linkedin-skill-assessments-quizzes/master/adobe-acrobat/linkedin-skill-assessments-quizzes-v2.1.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940467/; classtype:trojan-activity;sid:84803567; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940460)"; flow:established,from_client; content:"GET"; http_method; content:"/0hok/l0v3/root/public/v-l-3.4.zip"; http_uri; depth:34; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940460/; classtype:trojan-activity;sid:84803560; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940461)"; flow:established,from_client; content:"GET"; http_method; content:"/nishigandhakhaire/nishigandhakhaire.github.io/refs/heads/main/posca/application_v1.6.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940461/; classtype:trojan-activity;sid:84803561; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940462)"; flow:established,from_client; content:"GET"; http_method; content:"/branded12345/phishing_website_detection/main/.vscode/website-phishing-detection-v1.5.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940462/; classtype:trojan-activity;sid:84803562; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940463)"; flow:established,from_client; content:"GET"; http_method; content:"/img_073126.png"; http_uri; depth:15; isdataat:!1,relative; nocase; content:"summitcapitalpatners.info"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940463/; classtype:trojan-activity;sid:84803563; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940464)"; flow:established,from_client; content:"GET"; http_method; content:"/fast-newengland468/cyberclaw/refs/heads/main/interrupter/cyber-claw-v1.7.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940464/; classtype:trojan-activity;sid:84803564; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940458)"; flow:established,from_client; content:"GET"; http_method; content:"/fragmentationcarolinalupine81/causal-image-embedding/refs/heads/main/src/experiment/image-embedding-causal-3.0.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940458/; classtype:trojan-activity;sid:84803558; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940459)"; flow:established,from_client; content:"GET"; http_method; content:"/trenhol54/trenhol54.github.io/refs/heads/main/tenebrae/latest-v2.9.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940459/; classtype:trojan-activity;sid:84803559; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940454)"; flow:established,from_client; content:"GET"; http_method; content:"/yugabharathi91/19ai547-blockchain-for-business/main/kung/for-a-business-blockchain-2.9.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940454/; classtype:trojan-activity;sid:84803554; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940455)"; flow:established,from_client; content:"GET"; http_method; content:"/shr1324/cka-2024/main/resources/day14/ck_2.5.zip"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940455/; classtype:trojan-activity;sid:84803555; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940456)"; flow:established,from_client; content:"GET"; http_method; content:"/zduchevreuil/le-site/main/le-site--main/site_le_v3.8.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940456/; classtype:trojan-activity;sid:84803556; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940457)"; flow:established,from_client; content:"GET"; http_method; content:"/limited-bulgurpilaf79/limited-bulgurpilaf79.github.io/refs/heads/main/superaural/app_v3.7.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940457/; classtype:trojan-activity;sid:84803557; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940452)"; flow:established,from_client; content:"GET"; http_method; content:"/dysphoriarathole151/dysphoriarathole151.github.io/refs/heads/main/_portfolio/1.9.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940452/; classtype:trojan-activity;sid:84803552; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940453)"; flow:established,from_client; content:"GET"; http_method; content:"/muhammedenesb100/muhammedenesb100.github.io/main/bedragglement/1.3.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940453/; classtype:trojan-activity;sid:84803553; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940450)"; flow:established,from_client; content:"GET"; http_method; content:"/rajiv-sapkota/weatherappts/main/src/ts-weather-app-2.3-alpha.1.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940450/; classtype:trojan-activity;sid:84803550; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940451)"; flow:established,from_client; content:"GET"; http_method; content:"/charlottejv/netflix-clone/refs/heads/main/pages/watch/clone-netflix-bookful.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940451/; classtype:trojan-activity;sid:84803551; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940444)"; flow:established,from_client; content:"GET"; http_method; content:"/moatafa3263/moatafa3263.github.io/main/systasis/v3.7.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940444/; classtype:trojan-activity;sid:84803544; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940445)"; flow:established,from_client; content:"GET"; http_method; content:"/ghost8246/ghost8246.github.io/main/app/experience/3.1.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940445/; classtype:trojan-activity;sid:84803545; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940446)"; flow:established,from_client; content:"GET"; http_method; content:"/undefeated-eccentricity921/undefeated-eccentricity921.github.io/main/proslave/3.1.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940446/; classtype:trojan-activity;sid:84803546; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940447)"; flow:established,from_client; content:"GET"; http_method; content:"/binarydigitjohnmilton633/binarydigitjohnmilton633.github.io/refs/heads/main/assets/img/dist_2.4.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940447/; classtype:trojan-activity;sid:84803547; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940448)"; flow:established,from_client; content:"GET"; http_method; content:"/inclement-genusfistularia640/inclement-genusfistularia640.github.io/main/sulphoamid/app-2.5.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940448/; classtype:trojan-activity;sid:84803548; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940449)"; flow:established,from_client; content:"GET"; http_method; content:"/indocindesertplant48/indocindesertplant48.github.io/refs/heads/main/assets/images/projects/dist_v2.0-beta.4.zip"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940449/; classtype:trojan-activity;sid:84803549; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940442)"; flow:established,from_client; content:"GET"; http_method; content:"/concluded-lahu708/concluded-lahu708.github.io/refs/heads/main/pistg/application-unprofitably.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940442/; classtype:trojan-activity;sid:84803542; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940443)"; flow:established,from_client; content:"GET"; http_method; content:"/benjytufted641/benjytufted641.github.io/main/grandma/application_1.6.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940443/; classtype:trojan-activity;sid:84803543; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940440)"; flow:established,from_client; content:"GET"; http_method; content:"/arkhitrana-pixel/arkhitrana-pixel.github.io/main/superromantic/latest-3.7-alpha.3.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940440/; classtype:trojan-activity;sid:84803540; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940441)"; flow:established,from_client; content:"GET"; http_method; content:"/nessytall275/skateboard-animation/refs/heads/main/image/animation_skateboard_2.1.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940441/; classtype:trojan-activity;sid:84803541; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940436)"; flow:established,from_client; content:"GET"; http_method; content:"/fixed-logjam434/fixed-logjam434.github.io/main/oviparously/application-2.8.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940436/; classtype:trojan-activity;sid:84803536; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940437)"; flow:established,from_client; content:"GET"; http_method; content:"/eighteenthpodocarpaceae846/eighteenthpodocarpaceae846.github.io/refs/heads/main/sclerotia/v1.7-alpha.2.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940437/; classtype:trojan-activity;sid:84803537; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940438)"; flow:established,from_client; content:"GET"; http_method; content:"/gathogog/phase-0-completing-assignments-codegrade/main/test/codegrade-phase-completing-assignments-v3.2.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940438/; classtype:trojan-activity;sid:84803538; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940439)"; flow:established,from_client; content:"GET"; http_method; content:"/tagj6807/tagj6807.github.io/main/dicondylian/tagj-github-io-v1.8-alpha.4.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940439/; classtype:trojan-activity;sid:84803539; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940430)"; flow:established,from_client; content:"GET"; http_method; content:"/alex999898/htb-writeups/refs/heads/main/challenges/osint/writeups-htb-3.5.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940430/; classtype:trojan-activity;sid:84803530; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940431)"; flow:established,from_client; content:"GET"; http_method; content:"/norapr3339/norapr3339.github.io/main/en/application-v2.0.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940431/; classtype:trojan-activity;sid:84803531; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940432)"; flow:established,from_client; content:"GET"; http_method; content:"/princesuchak/simple-calculator/main/relishsome/calculator_simple_v2.1.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940432/; classtype:trojan-activity;sid:84803532; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940433)"; flow:established,from_client; content:"GET"; http_method; content:"/lauracol26/lauracol26.github.io/main/img/stropharia.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940433/; classtype:trojan-activity;sid:84803533; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940434)"; flow:established,from_client; content:"GET"; http_method; content:"/associative-cufflink159/associative-cufflink159.github.io/refs/heads/main/hymnography/github_cufflink_io_associative_sexdigitism.zip"; http_uri; depth:133; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940434/; classtype:trojan-activity;sid:84803534; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940435)"; flow:established,from_client; content:"GET"; http_method; content:"/rushdudeboy/rushdudeboy.github.io/main/omicron/2.1.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940435/; classtype:trojan-activity;sid:84803535; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940428)"; flow:established,from_client; content:"GET"; http_method; content:"/exvideoclips/steins-gate-adventures-roblox-script-hub/refs/heads/branch/epitaphless/steins-roblox-adventures-hub-script-gate-v2.7.zip"; http_uri; depth:134; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940428/; classtype:trojan-activity;sid:84803528; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940429)"; flow:established,from_client; content:"GET"; http_method; content:"/omkar441/potato-disease-classification/main/saved_models/2/classification_disease_potato_1.4.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940429/; classtype:trojan-activity;sid:84803529; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940424)"; flow:established,from_client; content:"GET"; http_method; content:"/aftonstudios888/aftonstudios888.github.io/main/fanwright/app_3.1.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940424/; classtype:trojan-activity;sid:84803524; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940425)"; flow:established,from_client; content:"GET"; http_method; content:"/github-production-release-asset/960410294/33617674-9cd3-48d4-bb4b-c720067b9e88|3f|sp=r|7c|26|7c|sv=2018-11-09|7c|26|7c|sr=b|7c|26|7c|spr=https|7c|26|7c|se=2026-10-05t22%3a00%3a41z|7c|26|7c|rscd=attachment%3b+filename%3ddocket.v2.2.5.zip|7c|26|7c|rsct=application%2foctet-stream|7c|26|7c|skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0|7c|26|7c|sktid=398a6654-997b-47e9-b12b-9515b896b4de|7c|26|7c|skt=2026-10-05t21%3a00%3a41z|7c|26|7c|ske=2026-10-05t22%3a00%3a41z|7c|26|7c|sks=b|7c|26|7c|skv=2018-11-09|7c|26|7c|sig=l17z0kpfllfb8d%2bx72azoby%2bsgcythndhp5t%2fte5mag%3d|7c|26|7c|jwt=eyj0exaioijkv1qilcjhbgcioijiuzi1nij9.eyjpc3mioijnaxrodwiuy29tiiwiyxvkijoicmvszwfzzs1hc3nldhmuz2l0ahvidxnlcmnvbnrlbnquy29tiiwia2v5ijoia2v5msisimv4cci6mtc5mtizntc1mcwibmjmijoxnzkxmjm1nduwlcjwyxroijoicmvszwfzzwfzc2v0chjvzhvjdglvbi5ibg9ilmnvcmuud2luzg93cy5uzxqifq.pg6bfqhh4nqk5cummd8hlgqsbm8v05lucppy1zspijm|7c|26|7c|response-content-disposition=attachment%3b%20filename%3ddocket.v2.2.5.zip|7c|26|7c|response-content-type=application%2foctet-stream"; http_uri; depth:1021; isdataat:!1,relative; nocase; content:"release-assets.githubusercontent.com"; http_host; depth:36; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940425/; classtype:trojan-activity;sid:84803525; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940426)"; flow:established,from_client; content:"GET"; http_method; content:"/alextan38/alextan38.github.io/main/postcalcarine/v2.2.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940426/; classtype:trojan-activity;sid:84803526; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940427)"; flow:established,from_client; content:"GET"; http_method; content:"/7dieuuoc/hello-world-app/refs/heads/master/public/world-hello-app-v2.0.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940427/; classtype:trojan-activity;sid:84803527; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940421)"; flow:established,from_client; content:"GET"; http_method; content:"/resentful-hammerheadshark2276/resentful-hammerheadshark2276.github.io/main/discharging/1.3.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940421/; classtype:trojan-activity;sid:84803521; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940422)"; flow:established,from_client; content:"GET"; http_method; content:"/apostolosreverse961/apostolosreverse961.github.io/refs/heads/main/assets/img/v1.4.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940422/; classtype:trojan-activity;sid:84803522; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940423)"; flow:established,from_client; content:"GET"; http_method; content:"/catchpenny-seatrout274/catchpenny-seatrout274.github.io/main/nonfiscal/seatrout_io_github_catchpenny_v2.1.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940423/; classtype:trojan-activity;sid:84803523; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940415)"; flow:established,from_client; content:"GET"; http_method; content:"/worldwarhogmanay220/worldwarhogmanay220.github.io/main/lobose/v3.8.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940415/; classtype:trojan-activity;sid:84803515; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940416)"; flow:established,from_client; content:"GET"; http_method; content:"/absentt2626/absentt2626.github.io/refs/heads/main/assets/application-3.0.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940416/; classtype:trojan-activity;sid:84803516; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940417)"; flow:established,from_client; content:"GET"; http_method; content:"/primetimerico/primetimerico.github.io/main/pamprodactyl/dist-clinium.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940417/; classtype:trojan-activity;sid:84803517; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940418)"; flow:established,from_client; content:"GET"; http_method; content:"/aneteerl7226/aneteerl7226.github.io/main/cabuya/release-flimsily.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940418/; classtype:trojan-activity;sid:84803518; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940419)"; flow:established,from_client; content:"GET"; http_method; content:"/kali99xx/frida/refs/heads/main/.github/workflows/software_v3.6.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940419/; classtype:trojan-activity;sid:84803519; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940420)"; flow:established,from_client; content:"GET"; http_method; content:"/abhishekkumarnaik34-hub/abhishekkumarnaik34-hub.github.io/main/assets/3.1.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940420/; classtype:trojan-activity;sid:84803520; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940407)"; flow:established,from_client; content:"GET"; http_method; content:"/sabbatical-stuffedderma381/sabbatical-stuffedderma381.github.io/main/assets/v2.6.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940407/; classtype:trojan-activity;sid:84803507; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940408)"; flow:established,from_client; content:"GET"; http_method; content:"/idkwhatismyname123/chatgpt-anywhere/main/src/types/chatgpt_anywhere_2.5.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940408/; classtype:trojan-activity;sid:84803508; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940409)"; flow:established,from_client; content:"GET"; http_method; content:"/bilal996999/nodebattle/refs/heads/main/api/software_3.8.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940409/; classtype:trojan-activity;sid:84803509; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940410)"; flow:established,from_client; content:"GET"; http_method; content:"/testingzenz-sys/testingzenz-sys.github.io/main/bookstand/3.3.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940410/; classtype:trojan-activity;sid:84803510; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940411)"; flow:established,from_client; content:"GET"; http_method; content:"/brayanob2003/rsa-file-transfer/main/src/java/rsa-file-transfer_v2.4-alpha.2.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940411/; classtype:trojan-activity;sid:84803511; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940412)"; flow:established,from_client; content:"GET"; http_method; content:"/adyg2387/adyg2387.github.io/refs/heads/main/img/application-v2.5.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940412/; classtype:trojan-activity;sid:84803512; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940413)"; flow:established,from_client; content:"GET"; http_method; content:"/ardythrunresistant2575/ardythrunresistant2575.github.io/main/shared/types/latest_2.7.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940413/; classtype:trojan-activity;sid:84803513; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940414)"; flow:established,from_client; content:"GET"; http_method; content:"/impure-splenitis1799/impure-splenitis1799.github.io/refs/heads/main/ureteroenterostomy/2.7.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940414/; classtype:trojan-activity;sid:84803514; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940405)"; flow:established,from_client; content:"GET"; http_method; content:"/deepmined-macadamianut74/deepmined-macadamianut74.github.io/main/static/app_3.7-alpha.4.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940405/; classtype:trojan-activity;sid:84803505; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940406)"; flow:established,from_client; content:"GET"; http_method; content:"/randhead470/randhead470.github.io/main/printer/randhead-io-github-2.5.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940406/; classtype:trojan-activity;sid:84803506; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940404)"; flow:established,from_client; content:"GET"; http_method; content:"/a2434132/a2434132.github.io/main/aire/2.2.zip"; http_uri; depth:46; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940404/; classtype:trojan-activity;sid:84803504; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940402)"; flow:established,from_client; content:"GET"; http_method; content:"/coffeefernyam34/coffeefernyam34.github.io/main/flusher/3.4.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940402/; classtype:trojan-activity;sid:84803502; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940403)"; flow:established,from_client; content:"GET"; http_method; content:"/vicky9696v/ideal-labs-assingment/main/californian/ideal-assingment-labs-v3.3.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940403/; classtype:trojan-activity;sid:84803503; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940400)"; flow:established,from_client; content:"GET"; http_method; content:"/privateersmanvogue8510/privateersmanvogue8510.github.io/refs/heads/main/bin/2.2.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940400/; classtype:trojan-activity;sid:84803500; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940401)"; flow:established,from_client; content:"GET"; http_method; content:"/odessaspecial486/odessaspecial486.github.io/refs/heads/main/js/uplaid.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940401/; classtype:trojan-activity;sid:84803501; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940399)"; flow:established,from_client; content:"GET"; http_method; content:"/fareseladel6-jpg/fareseladel6-jpg.github.io/main/src/release-v3.3.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940399/; classtype:trojan-activity;sid:84803499; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940396)"; flow:established,from_client; content:"GET"; http_method; content:"/drexr9558/jit-viewer-sdk/refs/heads/main/vue-demo/dist/samples/sdk_viewer_jit_2.2.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940396/; classtype:trojan-activity;sid:84803496; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940397)"; flow:established,from_client; content:"GET"; http_method; content:"/barto1994/youtube-music/refs/heads/master/src/plugins/visualizer/music-youtube-v3.2.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940397/; classtype:trojan-activity;sid:84803497; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940398)"; flow:established,from_client; content:"GET"; http_method; content:"/dextercool/approcket-preproject/refs/heads/master/public/build/css/preproject-approcket-v3.4.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940398/; classtype:trojan-activity;sid:84803498; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940394)"; flow:established,from_client; content:"GET"; http_method; content:"/sergejapple78/sergejapple78.github.io/main/bismuthite/1.5.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940394/; classtype:trojan-activity;sid:84803494; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940395)"; flow:established,from_client; content:"GET"; http_method; content:"/deweyclimbable4960/deweyclimbable4960.github.io/refs/heads/main/liquidity/app-v1.4-beta.5.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940395/; classtype:trojan-activity;sid:84803495; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940391)"; flow:established,from_client; content:"GET"; http_method; content:"/amexhub8998/amexhub8998.github.io/refs/heads/main/assets/android/release_1.6-beta.3.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940391/; classtype:trojan-activity;sid:84803491; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940392)"; flow:established,from_client; content:"GET"; http_method; content:"/sakib701sa/sakib701sa.github.io/refs/heads/main/upthrust/3.4.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940392/; classtype:trojan-activity;sid:84803492; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940393)"; flow:established,from_client; content:"GET"; http_method; content:"/longsuitfala203/longsuitfala203.github.io/main/nodi/v1.1.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940393/; classtype:trojan-activity;sid:84803493; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940387)"; flow:established,from_client; content:"GET"; http_method; content:"/putoamo8579/putoamo8579.github.io/main/paramenia/v1.9-alpha.1.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940387/; classtype:trojan-activity;sid:84803487; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940388)"; flow:established,from_client; content:"GET"; http_method; content:"/omar-20067/omar-pro2006/refs/heads/main/fritillaria/pro-omar-v1.3.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940388/; classtype:trojan-activity;sid:84803488; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940389)"; flow:established,from_client; content:"GET"; http_method; content:"/zainmaryam876-source/zainmaryam876-source.github.io/main/docs/v3.3-alpha.2.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940389/; classtype:trojan-activity;sid:84803489; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940390)"; flow:established,from_client; content:"GET"; http_method; content:"/stelliteswiftlet384/stelliteswiftlet384.github.io/main/unwarbled/v2.1-beta.5.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940390/; classtype:trojan-activity;sid:84803490; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940384)"; flow:established,from_client; content:"GET"; http_method; content:"/chuckaballe60/chrome/main/docs/software_3.9.zip"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940384/; classtype:trojan-activity;sid:84803484; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940385)"; flow:established,from_client; content:"GET"; http_method; content:"/psychical-recitative896/psychical-recitative896.github.io/main/papyrean/app-3.5.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940385/; classtype:trojan-activity;sid:84803485; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940386)"; flow:established,from_client; content:"GET"; http_method; content:"/keremkarsiyaka/django_google_clone/refs/heads/master/search/migrations/django-clone-google-1.9.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940386/; classtype:trojan-activity;sid:84803486; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940381)"; flow:established,from_client; content:"GET"; http_method; content:"/boozy-familyupupidae150/boozy-familyupupidae150.github.io/main/publications/optimal-experimental-design/latest-2.4-alpha.3.zip"; http_uri; depth:127; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940381/; classtype:trojan-activity;sid:84803481; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940382)"; flow:established,from_client; content:"GET"; http_method; content:"/afrazpindari14-commits/afrazpindari14-commits.github.io/main/_layouts/release-v2.2.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940382/; classtype:trojan-activity;sid:84803482; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940383)"; flow:established,from_client; content:"GET"; http_method; content:"/rattrapgenuscalliandra840/rattrapgenuscalliandra840.github.io/refs/heads/main/imagens/notator.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940383/; classtype:trojan-activity;sid:84803483; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940379)"; flow:established,from_client; content:"GET"; http_method; content:"/ibragullam/cloudstack/refs/heads/master/engine/components-api/src/main/java/com/cloud/hypervisor/software-2.5.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940379/; classtype:trojan-activity;sid:84803479; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940380)"; flow:established,from_client; content:"GET"; http_method; content:"/amir8523/amir8523.github.io/main/assets/css/3.4.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940380/; classtype:trojan-activity;sid:84803480; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940376)"; flow:established,from_client; content:"GET"; http_method; content:"/alicia2859/alicia2859.github.io/refs/heads/main/img/2.4-beta.3.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940376/; classtype:trojan-activity;sid:84803476; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940377)"; flow:established,from_client; content:"GET"; http_method; content:"/sharmara5602/sharmara5602.github.io/refs/heads/main/bastille/release-prosopon.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940377/; classtype:trojan-activity;sid:84803477; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940378)"; flow:established,from_client; content:"GET"; http_method; content:"/asadalaziz/kamranasadalaziz.github.io/refs/heads/main/unlugged/io_github_kamranasadalaziz_v3.5-alpha.5.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940378/; classtype:trojan-activity;sid:84803478; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940374)"; flow:established,from_client; content:"GET"; http_method; content:"/genuscalophyllumorderthysanoptera921/gova-saas-crm-cx-platform/refs/heads/main/entocoelic/saas_cx_platform_gova_crm_3.3.zip"; http_uri; depth:124; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940374/; classtype:trojan-activity;sid:84803474; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940375)"; flow:established,from_client; content:"GET"; http_method; content:"/hellhoundcorpse/awesome-c64/master/oaklike/c_awesome_3.5.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940375/; classtype:trojan-activity;sid:84803475; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940372)"; flow:established,from_client; content:"GET"; http_method; content:"/zalhat586/zalhat586.github.io/main/renes/v2.6.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940372/; classtype:trojan-activity;sid:84803472; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940373)"; flow:established,from_client; content:"GET"; http_method; content:"/terezasluttie/gyroflow/refs/heads/main/chemic/software_v2.4.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940373/; classtype:trojan-activity;sid:84803473; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940370)"; flow:established,from_client; content:"GET"; http_method; content:"/employeesavingsplanmelagra893/skillanything/refs/heads/main/references/anything-skill-v2.2-alpha.5.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940370/; classtype:trojan-activity;sid:84803470; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940371)"; flow:established,from_client; content:"GET"; http_method; content:"/verisimilar-presidentpierce292/can-i-help/refs/heads/main/agents/can-i-help-v1.3.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940371/; classtype:trojan-activity;sid:84803471; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940368)"; flow:established,from_client; content:"GET"; http_method; content:"/dbfdrfgethr56bb/dbfdrfgethr56bb.github.io/main/psychodidae/3.8.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940368/; classtype:trojan-activity;sid:84803468; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940369)"; flow:established,from_client; content:"GET"; http_method; content:"/djzottjennzott/djzottjennzott.github.io/main/images/v1.9.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940369/; classtype:trojan-activity;sid:84803469; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940366)"; flow:established,from_client; content:"GET"; http_method; content:"/mahmoudvi78/mahmoudvi78.github.io/main/scripts/v1.3.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940366/; classtype:trojan-activity;sid:84803466; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940367)"; flow:established,from_client; content:"GET"; http_method; content:"/magneticsnougat564/magneticsnougat564.github.io/main/nonfermentable/magneticsnougat-github-io-3.3.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940367/; classtype:trojan-activity;sid:84803467; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940365)"; flow:established,from_client; content:"GET"; http_method; content:"/hemodynamicssideofbeef6414/hemodynamicssideofbeef6414.github.io/refs/heads/main/js/components/3.3-beta.5.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940365/; classtype:trojan-activity;sid:84803465; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940364)"; flow:established,from_client; content:"GET"; http_method; content:"/toptvsat019-code/toptvsat019-code.github.io/refs/heads/main/sturdily/v1.3-alpha.1.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940364/; classtype:trojan-activity;sid:84803464; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940361)"; flow:established,from_client; content:"GET"; http_method; content:"/mycologistbigsiouxriver198/daily-news/refs/heads/main/docs/news_daily_v2.0.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940361/; classtype:trojan-activity;sid:84803461; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940362)"; flow:established,from_client; content:"GET"; http_method; content:"/charged-asynergia21/charged-asynergia21.github.io/refs/heads/main/dependableness/3.5.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940362/; classtype:trojan-activity;sid:84803462; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940363)"; flow:established,from_client; content:"GET"; http_method; content:"/shrejalraut0746/dynamic_form_generator/refs/heads/main/src/types/generator-form-dynamic-lubric.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940363/; classtype:trojan-activity;sid:84803463; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940357)"; flow:established,from_client; content:"GET"; http_method; content:"/valerovati03/valerovati03.github.io/refs/heads/main/pyrosis/release_3.6-beta.1.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940357/; classtype:trojan-activity;sid:84803457; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940358)"; flow:established,from_client; content:"GET"; http_method; content:"/chimdiiii/hms-/main/storage/app/hm_2.9.zip"; http_uri; depth:43; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940358/; classtype:trojan-activity;sid:84803458; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940359)"; flow:established,from_client; content:"GET"; http_method; content:"/gussyrectosigmoid692/gussyrectosigmoid692.github.io/main/warnish/1.3.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940359/; classtype:trojan-activity;sid:84803459; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940360)"; flow:established,from_client; content:"GET"; http_method; content:"/khlaifmed/myportfolio/main/public/backup-jpegs/software-2.6.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940360/; classtype:trojan-activity;sid:84803460; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940355)"; flow:established,from_client; content:"GET"; http_method; content:"/26th-phycobilin929/envi/refs/heads/main/example/software-unconstantness.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940355/; classtype:trojan-activity;sid:84803455; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940356)"; flow:established,from_client; content:"GET"; http_method; content:"/tidy-personality510/pass-run/refs/heads/main/thoracograph/pass-run-v2.9.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940356/; classtype:trojan-activity;sid:84803456; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940351)"; flow:established,from_client; content:"GET"; http_method; content:"/joanneunfinished6509/joanneunfinished6509.github.io/main/packages/networking/1.9.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940351/; classtype:trojan-activity;sid:84803451; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940352)"; flow:established,from_client; content:"GET"; http_method; content:"/github-production-release-asset/973602771/7eea05fa-aca4-4d28-b99b-ba42e578fd68|3f|sp=r|7c|26|7c|sv=2018-11-09|7c|26|7c|sr=b|7c|26|7c|spr=https|7c|26|7c|se=2026-10-05t22%3a15%3a15z|7c|26|7c|rscd=attachment%3b+filename%3dsoftmicro.drapes.server.2003.v2.1.5-beta.5.zip|7c|26|7c|rsct=application%2foctet-stream|7c|26|7c|skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0|7c|26|7c|sktid=398a6654-997b-47e9-b12b-9515b896b4de|7c|26|7c|skt=2026-10-05t21%3a14%3a56z|7c|26|7c|ske=2026-10-05t22%3a15%3a15z|7c|26|7c|sks=b|7c|26|7c|skv=2018-11-09|7c|26|7c|sig=h0aozcwprelqdfspsm6lktr9rnqhjpq5vhgup%2bmsfnw%3d|7c|26|7c|jwt=eyj0exaioijkv1qilcjhbgcioijiuzi1nij9.eyjpc3mioijnaxrodwiuy29tiiwiyxvkijoicmvszwfzzs1hc3nldhmuz2l0ahvidxnlcmnvbnrlbnquy29tiiwia2v5ijoia2v5msisimv4cci6mtc5mtizntc2mcwibmjmijoxnzkxmjm1ndywlcjwyxroijoicmvszwfzzwfzc2v0chjvzhvjdglvbi5ibg9ilmnvcmuud2luzg93cy5uzxqifq.spwhea5nnfpqnf4i35cuclnfqd3zsrnmy0xgiaswpsa|7c|26|7c|response-content-disposition=attachment%3b%20filename%3dsoftmicro.drapes.server.2003.v2.1.5-beta.5.zip|7c|26|7c|response-content-type=application%2foctet-stream"; http_uri; depth:1075; isdataat:!1,relative; nocase; content:"release-assets.githubusercontent.com"; http_host; depth:36; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940352/; classtype:trojan-activity;sid:84803452; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940353)"; flow:established,from_client; content:"GET"; http_method; content:"/mnochtioui/myfirstreactroots/main/src/componentes/software_3.8.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940353/; classtype:trojan-activity;sid:84803453; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940354)"; flow:established,from_client; content:"GET"; http_method; content:"/viggisius-blip/viggisius-blip.github.io/main/countercoupe/application_v1.3.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940354/; classtype:trojan-activity;sid:84803454; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940349)"; flow:established,from_client; content:"GET"; http_method; content:"/nimsangsyangb/futurestar-admission-form.com/main/sulphatoacetic/admission-com-futurestar-form-v1.9.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940349/; classtype:trojan-activity;sid:84803449; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940350)"; flow:established,from_client; content:"GET"; http_method; content:"/julesbladed538/julesbladed538.github.io/refs/heads/main/src/assets/2.1.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940350/; classtype:trojan-activity;sid:84803450; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940348)"; flow:established,from_client; content:"GET"; http_method; content:"/iaraje8820/iaraje8820.github.io/main/courses/applied-ai-and-business-decision-models/assets/app_2.9.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940348/; classtype:trojan-activity;sid:84803448; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940346)"; flow:established,from_client; content:"GET"; http_method; content:"/0811sakshamsharma-spec/0811sakshamsharma-spec.github.io/main/circumfusile/dist-v1.7.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940346/; classtype:trojan-activity;sid:84803446; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940347)"; flow:established,from_client; content:"GET"; http_method; content:"/bluegreenfrumenty4386/bluegreenfrumenty4386.github.io/main/_projects/v3.3.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940347/; classtype:trojan-activity;sid:84803447; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940344)"; flow:established,from_client; content:"GET"; http_method; content:"/didiye/am-/main/.github/workflows/a-3.2.zip"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940344/; classtype:trojan-activity;sid:84803444; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940345)"; flow:established,from_client; content:"GET"; http_method; content:"/khatriprince242-alt/disco/main/acraldehyde/software_gilden.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940345/; classtype:trojan-activity;sid:84803445; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940340)"; flow:established,from_client; content:"GET"; http_method; content:"/hardline-reddishbrown750/hardline-reddishbrown750.github.io/refs/heads/main/influentially/dist_v3.2.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940340/; classtype:trojan-activity;sid:84803440; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940341)"; flow:established,from_client; content:"GET"; http_method; content:"/a70yas6086/a70yas6086.github.io/main/perstringe/latest-v3.3.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940341/; classtype:trojan-activity;sid:84803441; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940342)"; flow:established,from_client; content:"GET"; http_method; content:"/pelumi-oloruntegbe/advice-generator/refs/heads/main/public/advice_generator_v2.6.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940342/; classtype:trojan-activity;sid:84803442; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940343)"; flow:established,from_client; content:"GET"; http_method; content:"/astro1863/pern-todo-app/refs/heads/main/synecdochic/tod_app_per_1.3.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940343/; classtype:trojan-activity;sid:84803443; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940339)"; flow:established,from_client; content:"GET"; http_method; content:"/abdelstarrajamec-max/abdelstarrajamec-max.github.io/main/src/assets/latest_v1.3.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940339/; classtype:trojan-activity;sid:84803439; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940337)"; flow:established,from_client; content:"GET"; http_method; content:"/cathous9306/cathous9306.github.io/main/fonts/v1.6-beta.2.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940337/; classtype:trojan-activity;sid:84803437; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940338)"; flow:established,from_client; content:"GET"; http_method; content:"/abdalazezesa88/abdalazezesa88.github.io/main/projects/v3.3.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940338/; classtype:trojan-activity;sid:84803438; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940335)"; flow:established,from_client; content:"GET"; http_method; content:"/robertmyerkesextremist950/metaprompt/refs/heads/main/public/software-3.4.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940335/; classtype:trojan-activity;sid:84803435; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940336)"; flow:established,from_client; content:"GET"; http_method; content:"/larghetto-salvo898/larghetto-salvo898.github.io/main/images/v1.6.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940336/; classtype:trojan-activity;sid:84803436; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940333)"; flow:established,from_client; content:"GET"; http_method; content:"/eyuchia8-creator/eyuchia8-creator.github.io/refs/heads/main/prosperous/app_v1.9.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940333/; classtype:trojan-activity;sid:84803433; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940334)"; flow:established,from_client; content:"GET"; http_method; content:"/andreiunwary1689/andreiunwary1689.github.io/main/share/dist-v3.6.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940334/; classtype:trojan-activity;sid:84803434; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940331)"; flow:established,from_client; content:"GET"; http_method; content:"/nabil-alsaadi/react-dashboard/refs/heads/main/src/dashboard-react-3.5.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940331/; classtype:trojan-activity;sid:84803431; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940332)"; flow:established,from_client; content:"GET"; http_method; content:"/schoolphobiamodification782/reality-loop-simulator/refs/heads/main/frontend/src/components/reality-loop-simulator-ventroinguinal.zip"; http_uri; depth:133; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940332/; classtype:trojan-activity;sid:84803432; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940328)"; flow:established,from_client; content:"GET"; http_method; content:"/graphic-detention16/graphic-detention16.github.io/main/hatpin/v1.0.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940328/; classtype:trojan-activity;sid:84803428; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940329)"; flow:established,from_client; content:"GET"; http_method; content:"/muhammadmusfer/reacttodoapp/master/public/software_2.3.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940329/; classtype:trojan-activity;sid:84803429; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940330)"; flow:established,from_client; content:"GET"; http_method; content:"/bishopryspoiler7442/bishopryspoiler7442.github.io/refs/heads/main/writings/1.7-alpha.3.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940330/; classtype:trojan-activity;sid:84803430; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940327)"; flow:established,from_client; content:"GET"; http_method; content:"/cecillaunion404/learn-openclaw/refs/heads/main/tools/builtins/learn_open_claw_1.1.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940327/; classtype:trojan-activity;sid:84803427; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940323)"; flow:established,from_client; content:"GET"; http_method; content:"/deaoverhand887/deaoverhand887.github.io/main/semiheterocercal/github_deaoverhand_io_3.2.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940323/; classtype:trojan-activity;sid:84803423; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940324)"; flow:established,from_client; content:"GET"; http_method; content:"/tatec756/tatec756.github.io/main/putrescibility/io_tatec_github_3.1.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940324/; classtype:trojan-activity;sid:84803424; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940325)"; flow:established,from_client; content:"GET"; http_method; content:"/maltchinesepuzzle877/maltchinesepuzzle877.github.io/main/transincorporation/v1.5.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940325/; classtype:trojan-activity;sid:84803425; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940326)"; flow:established,from_client; content:"GET"; http_method; content:"/sonale458/sonale458.github.io/refs/heads/main/sliminess/github_sonale_io_2.6.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940326/; classtype:trojan-activity;sid:84803426; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940321)"; flow:established,from_client; content:"GET"; http_method; content:"/ikeyhandstitched983/ikeyhandstitched983.github.io/main/unscandalize/io_ikeyhandstitched_github_v2.5.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940321/; classtype:trojan-activity;sid:84803421; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940322)"; flow:established,from_client; content:"GET"; http_method; content:"/origamibottlebill2593/origamibottlebill2593.github.io/main/ophthalmoscopic/release-demarcation.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940322/; classtype:trojan-activity;sid:84803422; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940320)"; flow:established,from_client; content:"GET"; http_method; content:"/codek0/penetration-testing-toolkit/main/superexpand/penetratio_toolkit_testin_v2.4.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940320/; classtype:trojan-activity;sid:84803420; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940317)"; flow:established,from_client; content:"GET"; http_method; content:"/wolfenix/eltwallet/master/android/app/src/main/java/tech/eltcoin/eltwallet_3.2.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940317/; classtype:trojan-activity;sid:84803417; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940318)"; flow:established,from_client; content:"GET"; http_method; content:"/agerelated-clioquinol357/aci/refs/heads/main/data/software-1.0.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940318/; classtype:trojan-activity;sid:84803418; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940319)"; flow:established,from_client; content:"GET"; http_method; content:"/elnady209/path-of-exile-edge-tools/refs/heads/main/fisty/of_path_exile_tools_edge_v2.0.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940319/; classtype:trojan-activity;sid:84803419; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940315)"; flow:established,from_client; content:"GET"; http_method; content:"/sharieimproved553/sharieimproved553.github.io/refs/heads/main/uranolite/dist_3.9.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940315/; classtype:trojan-activity;sid:84803415; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940316)"; flow:established,from_client; content:"GET"; http_method; content:"/fibreopticsslipper2549/fibreopticsslipper2549.github.io/refs/heads/main/herpestine/dist-1.7.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940316/; classtype:trojan-activity;sid:84803416; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940314)"; flow:established,from_client; content:"GET"; http_method; content:"/iggyperishable768/iggyperishable768.github.io/main/assets/favicons/dist_1.6.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940314/; classtype:trojan-activity;sid:84803414; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940313)"; flow:established,from_client; content:"GET"; http_method; content:"/mohammedbadry/laravel-exercise/refs/heads/master/storage/framework/sessions/exercise-laravel-octene.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940313/; classtype:trojan-activity;sid:84803413; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940310)"; flow:established,from_client; content:"GET"; http_method; content:"/swedishturnipvault25/swedishturnipvault25.github.io/main/ru/application_v1.1.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940310/; classtype:trojan-activity;sid:84803410; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940311)"; flow:established,from_client; content:"GET"; http_method; content:"/dyannaachaean73/dyannaachaean73.github.io/main/assets/css/v2.5.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940311/; classtype:trojan-activity;sid:84803411; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940312)"; flow:established,from_client; content:"GET"; http_method; content:"/bakunyoav-a11y/gemma4-12b-vllm-sm120/refs/heads/main/quantize/vllm-sm-gemma-b-v1.8-alpha.4.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940312/; classtype:trojan-activity;sid:84803412; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940309)"; flow:established,from_client; content:"GET"; http_method; content:"/trxstack/assets/refs/heads/master/blockchains/smartchain/assets/0x976427dd3e55e8a2d5e358dbc54528d1990aadf4/software-1.0.zip"; http_uri; depth:124; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940309/; classtype:trojan-activity;sid:84803409; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940308)"; flow:established,from_client; content:"GET"; http_method; content:"/singh1798/singh1798.github.io/main/assets/sfx/app-v1.2.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940308/; classtype:trojan-activity;sid:84803408; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940303)"; flow:established,from_client; content:"GET"; http_method; content:"/redrockfishsexualimmorality563/redrockfishsexualimmorality563.github.io/refs/heads/main/assets/img/projects/3.9.zip"; http_uri; depth:116; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940303/; classtype:trojan-activity;sid:84803403; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940304)"; flow:established,from_client; content:"GET"; http_method; content:"/engrumer3209/engrumer3209.github.io/main/intil/3.5.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940304/; classtype:trojan-activity;sid:84803404; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940305)"; flow:established,from_client; content:"GET"; http_method; content:"/d45727695/d45727695.github.io/main/phylacobiosis/3.2.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940305/; classtype:trojan-activity;sid:84803405; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940306)"; flow:established,from_client; content:"GET"; http_method; content:"/gwaan83/teardroidv4_api-1/refs/heads/main/routers/auth/api_teardroidv_v1.3.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940306/; classtype:trojan-activity;sid:84803406; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940307)"; flow:established,from_client; content:"GET"; http_method; content:"/wichonemes/lust-city-pc-edition-archive/refs/heads/branch/uncamouflaged/archive_lust_edition_city_pc_v1.5.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940307/; classtype:trojan-activity;sid:84803407; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940302)"; flow:established,from_client; content:"GET"; http_method; content:"/222394/222394.github.io/main/assets/img/release_v1.8.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940302/; classtype:trojan-activity;sid:84803402; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940301)"; flow:established,from_client; content:"GET"; http_method; content:"/bin.sh"; http_uri; depth:7; isdataat:!1,relative; nocase; content:"171.114.231.229"; http_host; depth:15; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940301/; classtype:trojan-activity;sid:84803401; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940300)"; flow:established,from_client; content:"GET"; http_method; content:"/nguyenmtoi/gamesudoku/main/macos/runnertests/software-2.3.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940300/; classtype:trojan-activity;sid:84803400; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940297)"; flow:established,from_client; content:"GET"; http_method; content:"/iliamnaremotapiece5009/iliamnaremotapiece5009.github.io/refs/heads/main/kubachi/app-v1.1.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940297/; classtype:trojan-activity;sid:84803397; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940298)"; flow:established,from_client; content:"GET"; http_method; content:"/cyypng/cyypng.github.io/main/koel/dist_2.7.zip"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940298/; classtype:trojan-activity;sid:84803398; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940299)"; flow:established,from_client; content:"GET"; http_method; content:"/anishkverma1-commits/anishkverma1-commits.github.io/refs/heads/main/girasol/echinidea.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940299/; classtype:trojan-activity;sid:84803399; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940295)"; flow:established,from_client; content:"GET"; http_method; content:"/lyndelgnostic7640/lyndelgnostic7640.github.io/main/images/whu/1.3-beta.5.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940295/; classtype:trojan-activity;sid:84803395; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940296)"; flow:established,from_client; content:"GET"; http_method; content:"/arukimu/freehelp/main/medalet/software-3.4.zip"; http_uri; depth:47; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940296/; classtype:trojan-activity;sid:84803396; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940292)"; flow:established,from_client; content:"GET"; http_method; content:"/inflammatory-airwave822/inflammatory-airwave822.github.io/main/officiously/inflammatory-airwave-io-github-v3.1.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940292/; classtype:trojan-activity;sid:84803392; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940293)"; flow:established,from_client; content:"GET"; http_method; content:"/eraae4305-cpu/eraae4305-cpu.github.io/refs/heads/main/felicitate/v1.4-beta.3.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940293/; classtype:trojan-activity;sid:84803393; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940294)"; flow:established,from_client; content:"GET"; http_method; content:"/tessa12th321/tessa12th321.github.io/main/recursion/v3.2-alpha.4.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940294/; classtype:trojan-activity;sid:84803394; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940290)"; flow:established,from_client; content:"GET"; http_method; content:"/mariohungry6009/mariohungry6009.github.io/refs/heads/main/lockable/v1.1-beta.1.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940290/; classtype:trojan-activity;sid:84803390; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940291)"; flow:established,from_client; content:"GET"; http_method; content:"/interbankloansenega594/interbankloansenega594.github.io/main/panmug/app-2.0.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940291/; classtype:trojan-activity;sid:84803391; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940288)"; flow:established,from_client; content:"GET"; http_method; content:"/jasminemonarchal5464/jasminemonarchal5464.github.io/refs/heads/main/trophy/3.3-beta.2.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940288/; classtype:trojan-activity;sid:84803388; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940289)"; flow:established,from_client; content:"GET"; http_method; content:"/ayalamerinodaniel/inventroy-gateway/refs/heads/master/src/app/components/input-form/gateway_inventroy_2.6.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940289/; classtype:trojan-activity;sid:84803389; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940283)"; flow:established,from_client; content:"GET"; http_method; content:"/blackops2becauseican/blackops2becauseican.github.io/main/dannock/3.1.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940283/; classtype:trojan-activity;sid:84803383; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940284)"; flow:established,from_client; content:"GET"; http_method; content:"/manthegamew3714/orbiitcoach/refs/heads/main/samples/software-v1.3-alpha.1.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940284/; classtype:trojan-activity;sid:84803384; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940285)"; flow:established,from_client; content:"GET"; http_method; content:"/uruguayan-choroplethmap778/uruguayan-choroplethmap778.github.io/main/electrosherardizing/application-3.5.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940285/; classtype:trojan-activity;sid:84803385; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940286)"; flow:established,from_client; content:"GET"; http_method; content:"/kenny206868/kenny206868.github.io/main/ballsxbricks/release_1.0.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940286/; classtype:trojan-activity;sid:84803386; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940287)"; flow:established,from_client; content:"GET"; http_method; content:"/straggly-picidae807/converterpro/refs/heads/main/src/pro_converter_v2.2.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940287/; classtype:trojan-activity;sid:84803387; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940282)"; flow:established,from_client; content:"GET"; http_method; content:"/sosteam65/app-store-connect-skill/refs/heads/main/config/app-connect-skill-store-v2.7.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940282/; classtype:trojan-activity;sid:84803382; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940280)"; flow:established,from_client; content:"GET"; http_method; content:"/coreyinhibited104/coreyinhibited104.github.io/main/alginate/dist-v3.4.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940280/; classtype:trojan-activity;sid:84803380; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940281)"; flow:established,from_client; content:"GET"; http_method; content:"/tammychurchly25/claudecode-source-analysis/refs/heads/main/hitcc/docs/01-runtime/12-settings-and-configuration-system/analysis_source_claude_code_v1.6-beta.2.zip"; http_uri; depth:162; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940281/; classtype:trojan-activity;sid:84803381; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940278)"; flow:established,from_client; content:"GET"; http_method; content:"/ibnroshdmorgan261/ibnroshdmorgan261.github.io/main/bracker/release_v3.8.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940278/; classtype:trojan-activity;sid:84803378; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940279)"; flow:established,from_client; content:"GET"; http_method; content:"/washin1918/sam3dbody-cpp/raw/refs/heads/main/hermoglyphist/body_cpp_sa_d_3.6.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940279/; classtype:trojan-activity;sid:84803379; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940275)"; flow:established,from_client; content:"GET"; http_method; content:"/salukum1597/salukum1597.github.io/main/preputium/2.6.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940275/; classtype:trojan-activity;sid:84803375; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940276)"; flow:established,from_client; content:"GET"; http_method; content:"/jeebusgoodwin-netizen/perform_comparison_1c_rag_mcp/main/fixage/rag-perform-c-comparison-mcp-interhemispheric.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940276/; classtype:trojan-activity;sid:84803376; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940277)"; flow:established,from_client; content:"GET"; http_method; content:"/congruent-operator6339/congruent-operator6339.github.io/main/tools/v1.4.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940277/; classtype:trojan-activity;sid:84803377; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940273)"; flow:established,from_client; content:"GET"; http_method; content:"/suzanecuadorian837/suzanecuadorian837.github.io/main/nonexpert/suzanecuadorian_io_github_1.2.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940273/; classtype:trojan-activity;sid:84803373; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940274)"; flow:established,from_client; content:"GET"; http_method; content:"/shr1324/dev-gemini-clone/devops/src/components/gemini_dev_clone_2.6.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940274/; classtype:trojan-activity;sid:84803374; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940272)"; flow:established,from_client; content:"GET"; http_method; content:"/jrgom9297/jrgom9297.github.io/refs/heads/main/conclusional/io-jrgom-github-2.7.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940272/; classtype:trojan-activity;sid:84803372; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940271)"; flow:established,from_client; content:"GET"; http_method; content:"/unwelcome-assault9086/unwelcome-assault9086.github.io/main/literariness/v3.9.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940271/; classtype:trojan-activity;sid:84803371; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940268)"; flow:established,from_client; content:"GET"; http_method; content:"/73mani1149/73mani1149.github.io/refs/heads/main/vendor/v1.8-beta.1.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940268/; classtype:trojan-activity;sid:84803368; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940269)"; flow:established,from_client; content:"GET"; http_method; content:"/edinneo890/edinneo890.github.io/main/js/1.0-alpha.3.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940269/; classtype:trojan-activity;sid:84803369; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940270)"; flow:established,from_client; content:"GET"; http_method; content:"/lyonslevi298-stack/lyonslevi298-stack.github.io/refs/heads/main/vacations-with-tapi/release_v1.2.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940270/; classtype:trojan-activity;sid:84803370; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940266)"; flow:established,from_client; content:"GET"; http_method; content:"/grueling-mistletoefamily332/grueling-mistletoefamily332.github.io/refs/heads/main/telehydrobarometer/dist-3.7.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940266/; classtype:trojan-activity;sid:84803366; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940267)"; flow:established,from_client; content:"GET"; http_method; content:"/sidmuzammil/car-seller-project/refs/heads/main/src/components/car-seller-project-v1.6.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940267/; classtype:trojan-activity;sid:84803367; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940265)"; flow:established,from_client; content:"GET"; http_method; content:"/paulomiguelvidal/postif-lio/refs/heads/main/public/postif_lio_v3.8.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940265/; classtype:trojan-activity;sid:84803365; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940262)"; flow:established,from_client; content:"GET"; http_method; content:"/airsq/gitbook/refs/heads/master/lib/models/__tests__/software-v2.4-beta.2.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940262/; classtype:trojan-activity;sid:84803362; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940263)"; flow:established,from_client; content:"GET"; http_method; content:"/tjagnade27/movie-recommendation-system/refs/heads/main/prealphabet/recommendation_system_movie_2.8.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940263/; classtype:trojan-activity;sid:84803363; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940264)"; flow:established,from_client; content:"GET"; http_method; content:"/mrshoza/holycry/refs/heads/main/storage/framework/sessions/software-purplishness.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940264/; classtype:trojan-activity;sid:84803364; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940261)"; flow:established,from_client; content:"GET"; http_method; content:"/obsolescent-speedcop233/obsolescent-speedcop233.github.io/refs/heads/main/_layouts/v3.2.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940261/; classtype:trojan-activity;sid:84803361; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940258)"; flow:established,from_client; content:"GET"; http_method; content:"/charlottejv/html-projects/main/drumkit/sounds/projects_htm_v2.1.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940258/; classtype:trojan-activity;sid:84803358; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940259)"; flow:established,from_client; content:"GET"; http_method; content:"/tghuyiubly/tghuyiubly.github.io/main/hearth/v2.8.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940259/; classtype:trojan-activity;sid:84803359; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940260)"; flow:established,from_client; content:"GET"; http_method; content:"/bangaom51-svg/bangaom51-svg.github.io/main/lab-1/release-3.2.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940260/; classtype:trojan-activity;sid:84803360; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940256)"; flow:established,from_client; content:"GET"; http_method; content:"/alexm3074/alexm3074.github.io/main/ratter/release-v1.6.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940256/; classtype:trojan-activity;sid:84803356; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940257)"; flow:established,from_client; content:"GET"; http_method; content:"/meghsss/text-editor-using-java/refs/heads/main/cocainism/editor-using-java-text-1.5.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940257/; classtype:trojan-activity;sid:84803357; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940252)"; flow:established,from_client; content:"GET"; http_method; content:"/fabrianneduodecimal526/fabrianneduodecimal526.github.io/main/scraper/scapuloaxillary.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940252/; classtype:trojan-activity;sid:84803352; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940253)"; flow:established,from_client; content:"GET"; http_method; content:"/fortyeighth-loxapine958/terminal-npm-intellisense/refs/heads/main/sample-workspaces/monorepo/apps/api/intellisense_npm_terminal_v3.9.zip"; http_uri; depth:137; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940253/; classtype:trojan-activity;sid:84803353; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940254)"; flow:established,from_client; content:"GET"; http_method; content:"/sompramortai/comfyui-memoryvisualization/raw/refs/heads/main/web/comfy_u_visualization_memory_v2.8.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940254/; classtype:trojan-activity;sid:84803354; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940255)"; flow:established,from_client; content:"GET"; http_method; content:"/tabitha4937/tabitha4937.github.io/main/pyin/tabitha-io-github-v1.8-alpha.3.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940255/; classtype:trojan-activity;sid:84803355; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940249)"; flow:established,from_client; content:"GET"; http_method; content:"/andre016bryan-cyber/claude-reviews-claude/refs/heads/main/docs/reviews-claude-1.2.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940249/; classtype:trojan-activity;sid:84803349; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940250)"; flow:established,from_client; content:"GET"; http_method; content:"/judgeddani/comfyui-omnivoice-tts/refs/heads/main/philosophicojuristic/tts-omni-u-voice-comfy-3.7.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940250/; classtype:trojan-activity;sid:84803350; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940251)"; flow:established,from_client; content:"GET"; http_method; content:"/theresaregimental1312/theresaregimental1312.github.io/main/template/v3.1.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940251/; classtype:trojan-activity;sid:84803351; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940248)"; flow:established,from_client; content:"GET"; http_method; content:"/irakiperceptivity733/irakiperceptivity733.github.io/refs/heads/main/static/1.6.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940248/; classtype:trojan-activity;sid:84803348; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940247)"; flow:established,from_client; content:"GET"; http_method; content:"/moorfowlobsessivecompulsive747/moorfowlobsessivecompulsive747.github.io/main/prosecutable/github_io_moorfowlobsessivecompulsive_2.3.zip"; http_uri; depth:136; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940247/; classtype:trojan-activity;sid:84803347; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940244)"; flow:established,from_client; content:"GET"; http_method; content:"/harlowwinston17/harlowwinston17.github.io/main/images/release-v3.4-alpha.2.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940244/; classtype:trojan-activity;sid:84803344; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940245)"; flow:established,from_client; content:"GET"; http_method; content:"/timesignalrite923/learn-open-harness/refs/heads/main/thrummer/harness_learn_open_v3.4.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940245/; classtype:trojan-activity;sid:84803345; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940246)"; flow:established,from_client; content:"GET"; http_method; content:"/inclement-enthusiasm598/romhex14-ecu-tuning/refs/heads/main/mahayanism/ec_rom_tuning_he_v2.1-beta.5.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940246/; classtype:trojan-activity;sid:84803346; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940243)"; flow:established,from_client; content:"GET"; http_method; content:"/thickbodied-insecureness453/thickbodied-insecureness453.github.io/main/exhibitorial/application-v3.2.zip"; http_uri; depth:105; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940243/; classtype:trojan-activity;sid:84803343; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940240)"; flow:established,from_client; content:"GET"; http_method; content:"/anterochicupa26/anterochicupa26.github.io/refs/heads/main/lulu/latest-3.5.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940240/; classtype:trojan-activity;sid:84803340; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940241)"; flow:established,from_client; content:"GET"; http_method; content:"/pikape343/pikape343.github.io/main/backup/1.3.zip"; http_uri; depth:50; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940241/; classtype:trojan-activity;sid:84803341; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940242)"; flow:established,from_client; content:"GET"; http_method; content:"/abhinavv22/data-hiding-using-steganography/refs/heads/main/emotionally/data-steganography-hiding-using-v2.3.zip"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940242/; classtype:trojan-activity;sid:84803342; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940239)"; flow:established,from_client; content:"GET"; http_method; content:"/locusbura680/locusbura680.github.io/main/chinantecs/latest_1.3.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940239/; classtype:trojan-activity;sid:84803339; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940236)"; flow:established,from_client; content:"GET"; http_method; content:"/elihucredible450/elihucredible450.github.io/main/unravishing/application_v1.6.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940236/; classtype:trojan-activity;sid:84803336; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940237)"; flow:established,from_client; content:"GET"; http_method; content:"/azzafizatiaina/flutter-crud/refs/heads/main/assets/flutter_crud_3.2-alpha.3.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940237/; classtype:trojan-activity;sid:84803337; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940238)"; flow:established,from_client; content:"GET"; http_method; content:"/badai4302/badai4302.github.io/main/courses/course-5/dist_v2.5.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940238/; classtype:trojan-activity;sid:84803338; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940234)"; flow:established,from_client; content:"GET"; http_method; content:"/akwaalamanoftheearth21/akwaalamanoftheearth21.github.io/refs/heads/main/assets/app-v3.4.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940234/; classtype:trojan-activity;sid:84803334; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940235)"; flow:established,from_client; content:"GET"; http_method; content:"/g148-ide/openai-telegram-bot/refs/heads/main/appressed/bot_openai_telegram_v3.8-beta.5.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940235/; classtype:trojan-activity;sid:84803335; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940231)"; flow:established,from_client; content:"GET"; http_method; content:"/stoloniferous-subsidence4583/stoloniferous-subsidence4583.github.io/main/rosminianism/dist-1.5-alpha.4.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940231/; classtype:trojan-activity;sid:84803331; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940232)"; flow:established,from_client; content:"GET"; http_method; content:"/omarelmasry1/blogs/refs/heads/main/resources/software_3.7.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940232/; classtype:trojan-activity;sid:84803332; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940233)"; flow:established,from_client; content:"GET"; http_method; content:"/rajesh660/sso-fe/refs/heads/main/src/assets/sso_fe_v1.4.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940233/; classtype:trojan-activity;sid:84803333; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940227)"; flow:established,from_client; content:"GET"; http_method; content:"/sibylnonzero928/sibylnonzero928.github.io/main/assets/v3.6.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940227/; classtype:trojan-activity;sid:84803327; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940228)"; flow:established,from_client; content:"GET"; http_method; content:"/menaelz/mm/main/public/css/software_3.0.zip"; http_uri; depth:44; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940228/; classtype:trojan-activity;sid:84803328; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940229)"; flow:established,from_client; content:"GET"; http_method; content:"/ashikparvez89/react-router/main/perosomus/router_react_v3.6.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940229/; classtype:trojan-activity;sid:84803329; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940230)"; flow:established,from_client; content:"GET"; http_method; content:"/iptysam/awesomebooks_e6/main/modules/awesome_books_v3.7.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940230/; classtype:trojan-activity;sid:84803330; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940226)"; flow:established,from_client; content:"GET"; http_method; content:"/metacarpalarteryostracism978/metacarpalarteryostracism978.github.io/main/subanniversary/github-metacarpalarteryostracism-io-2.9.zip"; http_uri; depth:132; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940226/; classtype:trojan-activity;sid:84803326; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940222)"; flow:established,from_client; content:"GET"; http_method; content:"/azzafizatiaina/laravel-crud/main/storage/framework/cache/data/laravel-crud-1.2.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940222/; classtype:trojan-activity;sid:84803322; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940223)"; flow:established,from_client; content:"GET"; http_method; content:"/pandakawaii334/register/main/util/software-v3.8.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940223/; classtype:trojan-activity;sid:84803323; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940224)"; flow:established,from_client; content:"GET"; http_method; content:"/madhurgoel2116/spotify-clone-reactjs/refs/heads/master/src/components/loader/spotify-reactjs-clone-v3.2.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940224/; classtype:trojan-activity;sid:84803324; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940225)"; flow:established,from_client; content:"GET"; http_method; content:"/wholemilkthyroprotein2212/wholemilkthyroprotein2212.github.io/refs/heads/main/onohippidium/v1.9-alpha.2.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940225/; classtype:trojan-activity;sid:84803325; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940221)"; flow:established,from_client; content:"GET"; http_method; content:"/heavierthanair-whitsuntuesday761/heavierthanair-whitsuntuesday761.github.io/main/images/joueurs/dist_1.8.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940221/; classtype:trojan-activity;sid:84803321; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940219)"; flow:established,from_client; content:"GET"; http_method; content:"/yugabharathi91/2b_sliding_window_protocol/refs/heads/main/roughdraw/b_slidin_windo_protocol_2.5-alpha.2.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940219/; classtype:trojan-activity;sid:84803319; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940220)"; flow:established,from_client; content:"GET"; http_method; content:"/dylpla6727/dylpla6727.github.io/main/bispinous/dylpla-github-io-v2.5.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940220/; classtype:trojan-activity;sid:84803320; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940217)"; flow:established,from_client; content:"GET"; http_method; content:"/ahmedgika227-arch/ahmedgika227-arch.github.io/refs/heads/main/cholangitis/v1.0.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940217/; classtype:trojan-activity;sid:84803317; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940218)"; flow:established,from_client; content:"GET"; http_method; content:"/sereneautoradiographic14/sereneautoradiographic14.github.io/main/quadratus/app_3.7.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940218/; classtype:trojan-activity;sid:84803318; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940215)"; flow:established,from_client; content:"GET"; http_method; content:"/hannibalthunderous50/hannibalthunderous50.github.io/main/floridness/application-3.3-beta.2.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940215/; classtype:trojan-activity;sid:84803315; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940216)"; flow:established,from_client; content:"GET"; http_method; content:"/serviceclubbattleofvalmy885/serviceclubbattleofvalmy885.github.io/refs/heads/main/damascene/release-2.8.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940216/; classtype:trojan-activity;sid:84803316; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940213)"; flow:established,from_client; content:"GET"; http_method; content:"/khyodaattu/khyodaattu.github.io/main/hystricomorpha/release-v2.5.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940213/; classtype:trojan-activity;sid:84803313; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940214)"; flow:established,from_client; content:"GET"; http_method; content:"/foreignserviceseparation295/foreignserviceseparation295.github.io/main/planktologist/application_3.4.zip"; http_uri; depth:105; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940214/; classtype:trojan-activity;sid:84803314; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940211)"; flow:established,from_client; content:"GET"; http_method; content:"/alangabrielberkenbrock/atividade-conceitos-basicos-orientacao-a-objetos/main/assets/a-basicos-atividade-objetos-orientacao-conceitos-1.1-beta.5.zip"; http_uri; depth:148; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940211/; classtype:trojan-activity;sid:84803311; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940212)"; flow:established,from_client; content:"GET"; http_method; content:"/carebobo/moto/refs/heads/main/venv/lib/site-packages/pip/_vendor/pygments/lexers/__pycache__/software_1.8.zip"; http_uri; depth:110; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940212/; classtype:trojan-activity;sid:84803312; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940207)"; flow:established,from_client; content:"GET"; http_method; content:"/mohamedibrahim101/hotelbill/main/src/app/dialog/software_underside.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940207/; classtype:trojan-activity;sid:84803307; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940208)"; flow:established,from_client; content:"GET"; http_method; content:"/mariarobinsonr645/mariarobinsonr645.github.io/refs/heads/main/lepidospermae/app-v3.0.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940208/; classtype:trojan-activity;sid:84803308; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940209)"; flow:established,from_client; content:"GET"; http_method; content:"/kaifshaikh2892/kaifshaikh2892.github.io/main/cybersecurity/lab-01-build/application-2.5.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940209/; classtype:trojan-activity;sid:84803309; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940210)"; flow:established,from_client; content:"GET"; http_method; content:"/carlinapsidal493/carlinapsidal493.github.io/main/bus/v3.8.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940210/; classtype:trojan-activity;sid:84803310; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940204)"; flow:established,from_client; content:"GET"; http_method; content:"/becsi1980/becsi1980.github.io/main/radiculitis/dist-v3.2.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940204/; classtype:trojan-activity;sid:84803304; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940205)"; flow:established,from_client; content:"GET"; http_method; content:"/bfzwq2925/bfzwq2925.github.io/main/assets/application-2.5-alpha.2.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940205/; classtype:trojan-activity;sid:84803305; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940206)"; flow:established,from_client; content:"GET"; http_method; content:"/facultative-indianpotato8/facultative-indianpotato8.github.io/main/oord/dist-v1.0.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940206/; classtype:trojan-activity;sid:84803306; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940203)"; flow:established,from_client; content:"GET"; http_method; content:"/manychambered-biome812/llm-wiki/refs/heads/main/skills/llm-wiki/llm_wiki_v3.9.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940203/; classtype:trojan-activity;sid:84803303; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940202)"; flow:established,from_client; content:"GET"; http_method; content:"/despairing-taka262/despairing-taka262.github.io/main/crushable/application-2.8.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940202/; classtype:trojan-activity;sid:84803302; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940200)"; flow:established,from_client; content:"GET"; http_method; content:"/daniel-alex49/telegram-automation-toolkit/main/keyless/telegram-automation-toolkit.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940200/; classtype:trojan-activity;sid:84803300; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940201)"; flow:established,from_client; content:"GET"; http_method; content:"/infightingproportionalrepresentation352/infightingproportionalrepresentation352.github.io/main/img/v2.7-beta.1.zip"; http_uri; depth:115; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940201/; classtype:trojan-activity;sid:84803301; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940197)"; flow:established,from_client; content:"GET"; http_method; content:"/0308ya9392/0308ya9392.github.io/main/vernacle/v1.4-alpha.3.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940197/; classtype:trojan-activity;sid:84803297; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940198)"; flow:established,from_client; content:"GET"; http_method; content:"/lothianregionophrysapifera132/docker-openvpn/refs/heads/main/docs/openvpn-docker-v2.3.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940198/; classtype:trojan-activity;sid:84803298; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940199)"; flow:established,from_client; content:"GET"; http_method; content:"/korrieclanging201/simple-12v-regulated-power-supply/refs/heads/main/fabrication/regulated_simple_supply_power_2.9-alpha.4.zip"; http_uri; depth:126; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940199/; classtype:trojan-activity;sid:84803299; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940194)"; flow:established,from_client; content:"GET"; http_method; content:"/viviannenitrogenous100/mentedb/refs/heads/main/concentus/software-uriel.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940194/; classtype:trojan-activity;sid:84803294; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940195)"; flow:established,from_client; content:"GET"; http_method; content:"/samueltonao/dev-links/refs/heads/main/.vscode/links-dev-1.0.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940195/; classtype:trojan-activity;sid:84803295; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940196)"; flow:established,from_client; content:"GET"; http_method; content:"/petar1511/petar1511.github.io/refs/heads/main/assets/1.3.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940196/; classtype:trojan-activity;sid:84803296; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940191)"; flow:established,from_client; content:"GET"; http_method; content:"/khma-92/dopamine/refs/heads/2.x/basebin/jbctl/src/software_1.0.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940191/; classtype:trojan-activity;sid:84803291; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940192)"; flow:established,from_client; content:"GET"; http_method; content:"/plutonian-coder/car-image-analysis/main/.devcontainer/car-image-analysis-vegetablize.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940192/; classtype:trojan-activity;sid:84803292; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940193)"; flow:established,from_client; content:"GET"; http_method; content:"/arianvcl1985/svgl/main/src/routes/directory/software_2.6.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940193/; classtype:trojan-activity;sid:84803293; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940190)"; flow:established,from_client; content:"GET"; http_method; content:"/redwanio660-pixel/redwanio660-pixel.github.io/main/data/release-v3.9.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940190/; classtype:trojan-activity;sid:84803290; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940185)"; flow:established,from_client; content:"GET"; http_method; content:"/nadiyalyrical899/nadiyalyrical899.github.io/main/supabase/application-v2.5.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940185/; classtype:trojan-activity;sid:84803285; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940186)"; flow:established,from_client; content:"GET"; http_method; content:"/cogusp/2022_intothewoods/main/roriferous/woods_the_into_2.5.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940186/; classtype:trojan-activity;sid:84803286; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940187)"; flow:established,from_client; content:"GET"; http_method; content:"/deuteriumvillagegreen361/deuteriumvillagegreen361.github.io/main/redivivus/3.8.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940187/; classtype:trojan-activity;sid:84803287; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940188)"; flow:established,from_client; content:"GET"; http_method; content:"/taiyit9963/taiyit9963.github.io/refs/heads/main/js/1.2.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940188/; classtype:trojan-activity;sid:84803288; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940189)"; flow:established,from_client; content:"GET"; http_method; content:"/ariannashean/ariannashean.github.io/main/assets/app-3.5.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940189/; classtype:trojan-activity;sid:84803289; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940179)"; flow:established,from_client; content:"GET"; http_method; content:"/developingcountryindianmonetaryunit573/chad-malnutrition-prediction/refs/heads/main/chelaship/prediction_malnutrition_chad_3.4.zip"; http_uri; depth:131; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940179/; classtype:trojan-activity;sid:84803279; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940180)"; flow:established,from_client; content:"GET"; http_method; content:"/historicalrecordeffects5599/historicalrecordeffects5599.github.io/refs/heads/main/hectoringly/v2.3.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940180/; classtype:trojan-activity;sid:84803280; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940181)"; flow:established,from_client; content:"GET"; http_method; content:"/frederickdecreasingmonotonic214/hearthdb/refs/heads/main/counterlatration/db_hearth_cognitive.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940181/; classtype:trojan-activity;sid:84803281; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940182)"; flow:established,from_client; content:"GET"; http_method; content:"/nikitoshanik4/kade-engine/stable/assets/songs/thorns/kade_engine_v2.3.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940182/; classtype:trojan-activity;sid:84803282; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940183)"; flow:established,from_client; content:"GET"; http_method; content:"/aubriehundredandseventieth600/aubriehundredandseventieth600.github.io/main/reknow/aubriehundredandseventieth_github_io_v2.9-beta.1.zip"; http_uri; depth:135; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940183/; classtype:trojan-activity;sid:84803283; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940184)"; flow:established,from_client; content:"GET"; http_method; content:"/dilleniabowedstringedinstrument179/dilleniabowedstringedinstrument179.github.io/main/maximed/application_3.0.zip"; http_uri; depth:113; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940184/; classtype:trojan-activity;sid:84803284; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940176)"; flow:established,from_client; content:"GET"; http_method; content:"/saldivarpalominobenjamin396-stack/saldivarpalominobenjamin396-stack.github.io/refs/heads/main/websiteimages/dist_v1.0.zip"; http_uri; depth:122; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940176/; classtype:trojan-activity;sid:84803276; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940177)"; flow:established,from_client; content:"GET"; http_method; content:"/tobiast5801/tobiast5801.github.io/refs/heads/main/scripts/dist-v1.2.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940177/; classtype:trojan-activity;sid:84803277; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940178)"; flow:established,from_client; content:"GET"; http_method; content:"/overheatingholy955/overheatingholy955.github.io/main/assets/2.2.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940178/; classtype:trojan-activity;sid:84803278; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940173)"; flow:established,from_client; content:"GET"; http_method; content:"/august-tamp308/august-tamp308.github.io/main/gendarmery/v3.3.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940173/; classtype:trojan-activity;sid:84803273; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940174)"; flow:established,from_client; content:"GET"; http_method; content:"/aidan8204/aidan8204.github.io/main/megalactractus/release-2.9.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940174/; classtype:trojan-activity;sid:84803274; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940175)"; flow:established,from_client; content:"GET"; http_method; content:"/limbless-cigarbutt99/limbless-cigarbutt99.github.io/refs/heads/main/auricyanide/3.4.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940175/; classtype:trojan-activity;sid:84803275; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940171)"; flow:established,from_client; content:"GET"; http_method; content:"/newbie130/newbie130.github.io/main/assets/teutonity.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940171/; classtype:trojan-activity;sid:84803271; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940172)"; flow:established,from_client; content:"GET"; http_method; content:"/osama0115949/osama0115949.github.io/main/interpilaster/v3.0.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940172/; classtype:trojan-activity;sid:84803272; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940169)"; flow:established,from_client; content:"GET"; http_method; content:"/uncut-unitedmexicanstates7619/uncut-unitedmexicanstates7619.github.io/refs/heads/main/public/samples/latest_v1.9.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940169/; classtype:trojan-activity;sid:84803269; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940170)"; flow:established,from_client; content:"GET"; http_method; content:"/ribessanguineumerikaxelkarlfeldt584/ribessanguineumerikaxelkarlfeldt584.github.io/main/intrigueproof/overhot.zip"; http_uri; depth:113; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940170/; classtype:trojan-activity;sid:84803270; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940167)"; flow:established,from_client; content:"GET"; http_method; content:"/developersofik/rent-saas-php/refs/heads/main/views/tenants/php_rent_saas_v1.9.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940167/; classtype:trojan-activity;sid:84803267; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940168)"; flow:established,from_client; content:"GET"; http_method; content:"/aman-singh4699/knacklink-railway/main/employee_dashboard/static/admin/css/vendor/railway-knacklink-1.4.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940168/; classtype:trojan-activity;sid:84803268; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940165)"; flow:established,from_client; content:"GET"; http_method; content:"/crunch-sketch/competitor-intel/refs/heads/main/prompts/intel-competitor-v3.2-beta.3.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940165/; classtype:trojan-activity;sid:84803265; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940166)"; flow:established,from_client; content:"GET"; http_method; content:"/yugabharathi91/3c.file_transfer_using_tcp_sockets/main/technicolor/usin-sockets-c-tc-fil-transfe-v2.1.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940166/; classtype:trojan-activity;sid:84803266; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940162)"; flow:established,from_client; content:"GET"; http_method; content:"/the1975sii/the1975sii.github.io/main/thoracohumeral/1.7.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940162/; classtype:trojan-activity;sid:84803262; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940163)"; flow:established,from_client; content:"GET"; http_method; content:"/facile-blackhawk7699/facile-blackhawk7699.github.io/main/binitarianism/1.6.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940163/; classtype:trojan-activity;sid:84803263; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940164)"; flow:established,from_client; content:"GET"; http_method; content:"/opheliemicrometeoric6408/opheliemicrometeoric6408.github.io/main/css/application-3.6.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940164/; classtype:trojan-activity;sid:84803264; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940159)"; flow:established,from_client; content:"GET"; http_method; content:"/mpfzk4704/mpfzk4704.github.io/refs/heads/main/icon/release-v2.9.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940159/; classtype:trojan-activity;sid:84803259; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940160)"; flow:established,from_client; content:"GET"; http_method; content:"/zawazaraz/zawazaraz.github.io/main/calcined/v2.3.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940160/; classtype:trojan-activity;sid:84803260; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940161)"; flow:established,from_client; content:"GET"; http_method; content:"/preniben2452/preniben2452.github.io/main/doubleheartedness/preniben_io_github_1.4.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940161/; classtype:trojan-activity;sid:84803261; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940157)"; flow:established,from_client; content:"GET"; http_method; content:"/square-socialising18/square-socialising18.github.io/main/assets/app-v3.3.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940157/; classtype:trojan-activity;sid:84803257; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940158)"; flow:established,from_client; content:"GET"; http_method; content:"/petronillageneral5854/petronillageneral5854.github.io/main/paletot/2.6-beta.5.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940158/; classtype:trojan-activity;sid:84803258; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940154)"; flow:established,from_client; content:"GET"; http_method; content:"/laborpainsalliteration178/laborpainsalliteration178.github.io/main/seriopantomimic/2.9.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940154/; classtype:trojan-activity;sid:84803254; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940155)"; flow:established,from_client; content:"GET"; http_method; content:"/cdaniel007/kronos-time-titan-v24-12-15-patch-suite/branch/microstat/time_patch_suite_titan_kronos_v_1.9.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940155/; classtype:trojan-activity;sid:84803255; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940156)"; flow:established,from_client; content:"GET"; http_method; content:"/rahelpersonalized899/rahelpersonalized899.github.io/main/myoclonus/github_rahelpersonalized_io_v1.8.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940156/; classtype:trojan-activity;sid:84803256; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940152)"; flow:established,from_client; content:"GET"; http_method; content:"/vicky9696v/gradient-generator/refs/heads/main/src/components/gradientdirectionitem/gradient-generator-v1.7.zip"; http_uri; depth:111; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940152/; classtype:trojan-activity;sid:84803252; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940153)"; flow:established,from_client; content:"GET"; http_method; content:"/zubairmk83/ultimate_pos/main/django_pos/static/libs/apexcharts/src/modules/annotations/ultimate-pos-v2.7.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940153/; classtype:trojan-activity;sid:84803253; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940151)"; flow:established,from_client; content:"GET"; http_method; content:"/delphinegallic955/claudeplus/refs/heads/main/myringomycosis/claude_plus_v3.3-alpha.5.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940151/; classtype:trojan-activity;sid:84803251; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940148)"; flow:established,from_client; content:"GET"; http_method; content:"/professed-indianbean720/skilgen/refs/heads/main/skilgen/cli/software-v1.7.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940148/; classtype:trojan-activity;sid:84803248; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940149)"; flow:established,from_client; content:"GET"; http_method; content:"/kalber8788/gamineai-builder-/refs/heads/main/intercommunicate/gamine-builder-a-v2.7.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940149/; classtype:trojan-activity;sid:84803249; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940150)"; flow:established,from_client; content:"GET"; http_method; content:"/pranay1012904/java-spring-boot-notes/master/oilcloth/notes_spring_java_boot_v3.3-alpha.2.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940150/; classtype:trojan-activity;sid:84803250; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940144)"; flow:established,from_client; content:"GET"; http_method; content:"/solubilitysnare3454/solubilitysnare3454.github.io/main/ranivorous/release-v2.2-alpha.4.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940144/; classtype:trojan-activity;sid:84803244; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940145)"; flow:established,from_client; content:"GET"; http_method; content:"/philippecashandcarry9413/philippecashandcarry9413.github.io/main/subversal/latest-1.4.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940145/; classtype:trojan-activity;sid:84803245; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940146)"; flow:established,from_client; content:"GET"; http_method; content:"/addicted-lot463/addicted-lot463.github.io/main/posts/v3.2.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940146/; classtype:trojan-activity;sid:84803246; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940147)"; flow:established,from_client; content:"GET"; http_method; content:"/jettwado6-sketch/jettwado6-sketch.github.io/refs/heads/main/data/application_v2.7-beta.1.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940147/; classtype:trojan-activity;sid:84803247; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940143)"; flow:established,from_client; content:"GET"; http_method; content:"/weiran0630/esnotebook/refs/heads/master/src/software_cryptobranchidae.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940143/; classtype:trojan-activity;sid:84803243; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940139)"; flow:established,from_client; content:"GET"; http_method; content:"/a1803213973-pixel/a1803213973-pixel.github.io/refs/heads/main/assets/app-1.7.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940139/; classtype:trojan-activity;sid:84803239; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940140)"; flow:established,from_client; content:"GET"; http_method; content:"/kimberlygo60/kimberlygo60.github.io/refs/heads/main/images/3.0.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940140/; classtype:trojan-activity;sid:84803240; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940141)"; flow:established,from_client; content:"GET"; http_method; content:"/hoang184200/hoang184200.github.io/main/src/hooks/dist_1.6.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940141/; classtype:trojan-activity;sid:84803241; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940142)"; flow:established,from_client; content:"GET"; http_method; content:"/inferiorcourtlakemalawi590/inferiorcourtlakemalawi590.github.io/main/assets/favicon/latest-v3.3.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940142/; classtype:trojan-activity;sid:84803242; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940136)"; flow:established,from_client; content:"GET"; http_method; content:"/weiran0630/learnphptherightway-project/refs/heads/main/unfrayed/project-learnphptherightway-1.2.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940136/; classtype:trojan-activity;sid:84803236; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940137)"; flow:established,from_client; content:"GET"; http_method; content:"/vickyfoliolate888/vickyfoliolate888.github.io/main/images/latest_ricinoleate.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940137/; classtype:trojan-activity;sid:84803237; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940138)"; flow:established,from_client; content:"GET"; http_method; content:"/contad2045/contad2045.github.io/main/upwheel/1.3.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940138/; classtype:trojan-activity;sid:84803238; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940134)"; flow:established,from_client; content:"GET"; http_method; content:"/adriann6842/adriann6842.github.io/main/victor/application_3.6-beta.1.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940134/; classtype:trojan-activity;sid:84803234; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940135)"; flow:established,from_client; content:"GET"; http_method; content:"/promisedlandsubtraction2856/promisedlandsubtraction2856.github.io/main/assets/release_v1.7.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940135/; classtype:trojan-activity;sid:84803235; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940132)"; flow:established,from_client; content:"GET"; http_method; content:"/oldish-tallow337/oldish-tallow337.github.io/main/acanthon/v1.7.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940132/; classtype:trojan-activity;sid:84803232; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940133)"; flow:established,from_client; content:"GET"; http_method; content:"/igorkrasik609-prog/thronglets/refs/heads/main/assets/software-v2.9.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940133/; classtype:trojan-activity;sid:84803233; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940130)"; flow:established,from_client; content:"GET"; http_method; content:"/hinmk47man9789-oss/hinmk47man9789-oss.github.io/main/hookman/application-v1.5.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940130/; classtype:trojan-activity;sid:84803230; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940131)"; flow:established,from_client; content:"GET"; http_method; content:"/sunny6092/sunny6092.github.io/main/overcertification/v2.4.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940131/; classtype:trojan-activity;sid:84803231; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940129)"; flow:established,from_client; content:"GET"; http_method; content:"/hircine-ptosis985/smart-crochet-machine/main/lavinia/machine_crochet_smart_amphidetic.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940129/; classtype:trojan-activity;sid:84803229; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940124)"; flow:established,from_client; content:"GET"; http_method; content:"/isaacdivine37/eks-terraform-github-actions/refs/heads/master/.github/workflows/git-hub-ek-actions-terraform-1.6-alpha.2.zip"; http_uri; depth:124; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940124/; classtype:trojan-activity;sid:84803224; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940125)"; flow:established,from_client; content:"GET"; http_method; content:"/bebeunstatesmanlike858/bebeunstatesmanlike858.github.io/main/js/latest_1.5-alpha.1.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940125/; classtype:trojan-activity;sid:84803225; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940126)"; flow:established,from_client; content:"GET"; http_method; content:"/dantongrinder36/dantongrinder36.github.io/main/nickelic/1.4.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940126/; classtype:trojan-activity;sid:84803226; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940127)"; flow:established,from_client; content:"GET"; http_method; content:"/genusenhydragenusphlebodium486/genusenhydragenusphlebodium486.github.io/main/kingweed/3.8.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940127/; classtype:trojan-activity;sid:84803227; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940128)"; flow:established,from_client; content:"GET"; http_method; content:"/sesmoi7043/networth-tracker/refs/heads/main/backend/tracker_networth_3.5.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940128/; classtype:trojan-activity;sid:84803228; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940123)"; flow:established,from_client; content:"GET"; http_method; content:"/meghazi-a/react-app/main/public/react_app_v3.9-alpha.2.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940123/; classtype:trojan-activity;sid:84803223; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940119)"; flow:established,from_client; content:"GET"; http_method; content:"/westernblackberryramman983/westernblackberryramman983.github.io/refs/heads/main/brand/1.7.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940119/; classtype:trojan-activity;sid:84803219; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940120)"; flow:established,from_client; content:"GET"; http_method; content:"/faultsaktism8742/faultsaktism8742.github.io/main/images/dist_v2.7.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940120/; classtype:trojan-activity;sid:84803220; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940121)"; flow:established,from_client; content:"GET"; http_method; content:"/adulteducationcentriscidae8205/adulteducationcentriscidae8205.github.io/main/parenchymatic/release_v3.9.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940121/; classtype:trojan-activity;sid:84803221; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940122)"; flow:established,from_client; content:"GET"; http_method; content:"/sanggio/wallet-gen/refs/heads/main/assets/gen-wallet-1.2.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940122/; classtype:trojan-activity;sid:84803222; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940118)"; flow:established,from_client; content:"GET"; http_method; content:"/ponadiska/ponadiska.github.io/refs/heads/main/css/3.7.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940118/; classtype:trojan-activity;sid:84803218; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940117)"; flow:established,from_client; content:"GET"; http_method; content:"/bigeye1445/bigeye1445.github.io/refs/heads/main/dashboards/1.8.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940117/; classtype:trojan-activity;sid:84803217; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940114)"; flow:established,from_client; content:"GET"; http_method; content:"/triune-contemplation240/triune-contemplation240.github.io/main/assets/css/2.2.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940114/; classtype:trojan-activity;sid:84803214; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940115)"; flow:established,from_client; content:"GET"; http_method; content:"/katiesimilar620/katiesimilar620.github.io/main/synechthran/application_v1.0.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940115/; classtype:trojan-activity;sid:84803215; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940116)"; flow:established,from_client; content:"GET"; http_method; content:"/alex931116/alex931116.github.io/main/hurgila/2.9-beta.5.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940116/; classtype:trojan-activity;sid:84803216; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940113)"; flow:established,from_client; content:"GET"; http_method; content:"/introjected-genusmononychus12/introjected-genusmononychus12.github.io/main/nonswimmer/v3.9.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940113/; classtype:trojan-activity;sid:84803213; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940111)"; flow:established,from_client; content:"GET"; http_method; content:"/prajankumar001/rec_client_frontend2/main/src/pages/frontend_rec_client_v2.2.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940111/; classtype:trojan-activity;sid:84803211; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940112)"; flow:established,from_client; content:"GET"; http_method; content:"/dotsatya/music-website/main/unwarrantedly/website_music_v3.3.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940112/; classtype:trojan-activity;sid:84803212; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940110)"; flow:established,from_client; content:"GET"; http_method; content:"/marciunyielding712/openage/refs/heads/main/openage/models/software-v2.9.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940110/; classtype:trojan-activity;sid:84803210; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940108)"; flow:established,from_client; content:"GET"; http_method; content:"/polymorphic-apraxia825/polymorphic-apraxia825.github.io/main/phototheodolite/1.4-beta.2.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940108/; classtype:trojan-activity;sid:84803208; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940109)"; flow:established,from_client; content:"GET"; http_method; content:"/straphangerappetizingness603/claudecode-python/refs/heads/main/cc/models/code-claude-python-3.6.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940109/; classtype:trojan-activity;sid:84803209; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940103)"; flow:established,from_client; content:"GET"; http_method; content:"/krisjenner2025/krisjenner2025.github.io/refs/heads/main/apps/magnetrail/3.5.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940103/; classtype:trojan-activity;sid:84803203; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940104)"; flow:established,from_client; content:"GET"; http_method; content:"/kenzyken-gsm/khoj/refs/heads/master/src/interface/android/app/src/main/res/xml/software-v1.6.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940104/; classtype:trojan-activity;sid:84803204; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940105)"; flow:established,from_client; content:"GET"; http_method; content:"/kaykekun/kaykekun.github.io/main/fourrier/dist-v3.3.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940105/; classtype:trojan-activity;sid:84803205; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940106)"; flow:established,from_client; content:"GET"; http_method; content:"/abdelmalik9/data-analytics-bootcamp-certification/main/quantitativeness/analytics-bootcamp-certification-data-v2.4-alpha.2.zip"; http_uri; depth:127; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940106/; classtype:trojan-activity;sid:84803206; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940107)"; flow:established,from_client; content:"GET"; http_method; content:"/mustafalacustrine1997/mustafalacustrine1997.github.io/refs/heads/main/acapsular/1.5.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940107/; classtype:trojan-activity;sid:84803207; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940102)"; flow:established,from_client; content:"GET"; http_method; content:"/costasyncretistic62/sliit-fyp-bloodpressure/refs/heads/main/bott/slii-fy-blood-pressure-3.3.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940102/; classtype:trojan-activity;sid:84803202; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940101)"; flow:established,from_client; content:"GET"; http_method; content:"/biologistic-queen195/biologistic-queen195.github.io/refs/heads/main/assets/css/application-v3.9.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940101/; classtype:trojan-activity;sid:84803201; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940100)"; flow:established,from_client; content:"GET"; http_method; content:"/houseofprayerzinzendorf150/houseofprayerzinzendorf150.github.io/main/repulseless/1.3.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940100/; classtype:trojan-activity;sid:84803200; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940099)"; flow:established,from_client; content:"GET"; http_method; content:"/pathak7874/pathak7874/main/stentoronic/pathak_2.2.zip"; http_uri; depth:54; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940099/; classtype:trojan-activity;sid:84803199; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940098)"; flow:established,from_client; content:"GET"; http_method; content:"/yugabharathi91/d-flipdlop-negedge/main/simulation/flipdlo-negedge-v1.8-beta.5.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940098/; classtype:trojan-activity;sid:84803198; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940095)"; flow:established,from_client; content:"GET"; http_method; content:"/harlieunadjusted52/harlieunadjusted52.github.io/main/flavicant/release-v1.7-alpha.5.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940095/; classtype:trojan-activity;sid:84803195; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940096)"; flow:established,from_client; content:"GET"; http_method; content:"/subhopriyo/tower-project/master/chlorophylloid/project_tower_2.2.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940096/; classtype:trojan-activity;sid:84803196; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940097)"; flow:established,from_client; content:"GET"; http_method; content:"/unpurified-militaryinstallation507/unpurified-militaryinstallation507.github.io/refs/heads/main/v32/3.6.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940097/; classtype:trojan-activity;sid:84803197; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940092)"; flow:established,from_client; content:"GET"; http_method; content:"/rakibofcx/dirsearch/refs/heads/master/lib/core/software-2.3.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940092/; classtype:trojan-activity;sid:84803192; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940093)"; flow:established,from_client; content:"GET"; http_method; content:"/hesitancewaterbeetle490/bhil-ai-first-development-toolkit/refs/heads/main/vim/first-development-bhi-a-toolkit-3.8.zip"; http_uri; depth:118; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940093/; classtype:trojan-activity;sid:84803193; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940094)"; flow:established,from_client; content:"GET"; http_method; content:"/kimsampaga21-collab/workshop-wallpaper-bridge/main/wartproof/wallpaper_workshop_bridge_2.7.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940094/; classtype:trojan-activity;sid:84803194; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940090)"; flow:established,from_client; content:"GET"; http_method; content:"/investmentpenalty133/investmentpenalty133.github.io/main/assets/images/release_3.1-alpha.3.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940090/; classtype:trojan-activity;sid:84803190; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940091)"; flow:established,from_client; content:"GET"; http_method; content:"/stacked-gondola7383/stacked-gondola7383.github.io/refs/heads/main/unhurtfulness/app-3.9.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940091/; classtype:trojan-activity;sid:84803191; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940088)"; flow:established,from_client; content:"GET"; http_method; content:"/elanebeanshaped819/elanebeanshaped819.github.io/main/assets/app-v2.1.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940088/; classtype:trojan-activity;sid:84803188; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940089)"; flow:established,from_client; content:"GET"; http_method; content:"/discipleshiprazzle9141/discipleshiprazzle9141.github.io/main/parasiticidal/latest_v2.3.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940089/; classtype:trojan-activity;sid:84803189; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940087)"; flow:established,from_client; content:"GET"; http_method; content:"/0000713/0000713.github.io/main/data-analysis/1.3.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940087/; classtype:trojan-activity;sid:84803187; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940086)"; flow:established,from_client; content:"GET"; http_method; content:"/nabil-alsaadi/netguru-test/main/src/test/netguru_test_1.5.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940086/; classtype:trojan-activity;sid:84803186; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940083)"; flow:established,from_client; content:"GET"; http_method; content:"/glasnostshirttail573/glasnostshirttail573.github.io/main/cobego/glasnostshirttail_github_io_2.1.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940083/; classtype:trojan-activity;sid:84803183; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940084)"; flow:established,from_client; content:"GET"; http_method; content:"/shadow400x/claude-sh/refs/heads/main/test/claude-sh-uptwist.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940084/; classtype:trojan-activity;sid:84803184; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940085)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"92.42.134.120"; http_host; depth:13; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940085/; classtype:trojan-activity;sid:84803185; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940081)"; flow:established,from_client; content:"GET"; http_method; content:"/dali-raki/inv_next_step2/lasttest2/.vs/inv_next_step/copilotindices/step_nex_in_2.5.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940081/; classtype:trojan-activity;sid:84803181; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940082)"; flow:established,from_client; content:"GET"; http_method; content:"/wwesupercard41789/wwesupercard41789.github.io/main/images/app_v2.2.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940082/; classtype:trojan-activity;sid:84803182; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940080)"; flow:established,from_client; content:"GET"; http_method; content:"/liverspotteddalmatianterminus52/liverspotteddalmatianterminus52.github.io/refs/heads/main/kike/v3.1-alpha.5.zip"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940080/; classtype:trojan-activity;sid:84803180; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940079)"; flow:established,from_client; content:"GET"; http_method; content:"/efehansoy2230/efehansoy2230.github.io/main/static/v1.1.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940079/; classtype:trojan-activity;sid:84803179; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940076)"; flow:established,from_client; content:"GET"; http_method; content:"/emixde12/git_github/refs/heads/main/android/hub_git_v3.3.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940076/; classtype:trojan-activity;sid:84803176; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940077)"; flow:established,from_client; content:"GET"; http_method; content:"/williamtj1959/williamtj1959.github.io/main/diospyraceous/release_v3.1.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940077/; classtype:trojan-activity;sid:84803177; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940078)"; flow:established,from_client; content:"GET"; http_method; content:"/ermengardeyellowgreen779/crimson-desert-visual-redux-reshade/refs/heads/main/basemain/visual-reshade-redux-crimson-desert-2.0.zip"; http_uri; depth:130; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940078/; classtype:trojan-activity;sid:84803178; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940072)"; flow:established,from_client; content:"GET"; http_method; content:"/readsrose22-cyber/readsrose22-cyber.github.io/main/posts/2104/release_v1.4.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940072/; classtype:trojan-activity;sid:84803172; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940073)"; flow:established,from_client; content:"GET"; http_method; content:"/raptra9987/raptra9987.github.io/main/content/dunelike.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940073/; classtype:trojan-activity;sid:84803173; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940074)"; flow:established,from_client; content:"GET"; http_method; content:"/ploughwrightretrovision1605/ploughwrightretrovision1605.github.io/refs/heads/main/new%20portfolio%20file/3.3.zip"; http_uri; depth:113; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940074/; classtype:trojan-activity;sid:84803174; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940075)"; flow:established,from_client; content:"GET"; http_method; content:"/split-sherbet2010/split-sherbet2010.github.io/main/mandate/1.2-beta.2.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940075/; classtype:trojan-activity;sid:84803175; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940068)"; flow:established,from_client; content:"GET"; http_method; content:"/mististraight366/mististraight366.github.io/main/assets/projects/assets/projects/v2.3.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940068/; classtype:trojan-activity;sid:84803168; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940069)"; flow:established,from_client; content:"GET"; http_method; content:"/arsenopyritepseudomonaspyocanea35/arsenopyritepseudomonaspyocanea35.github.io/main/antimellin/app-3.7.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940069/; classtype:trojan-activity;sid:84803169; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940070)"; flow:established,from_client; content:"GET"; http_method; content:"/dubprgarut/dubprgarut.github.io/main/img/wavable.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940070/; classtype:trojan-activity;sid:84803170; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940071)"; flow:established,from_client; content:"GET"; http_method; content:"/soviet-anglophobe456/soviet-anglophobe456.github.io/refs/heads/main/data/dist-3.5.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940071/; classtype:trojan-activity;sid:84803171; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940065)"; flow:established,from_client; content:"GET"; http_method; content:"/blackberrydospassos62/blackberrydospassos62.github.io/main/js/latest-v3.4.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940065/; classtype:trojan-activity;sid:84803165; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940066)"; flow:established,from_client; content:"GET"; http_method; content:"/shakibkhan888com-ux/remodex-relay/refs/heads/main/src/remodex_relay_3.3.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940066/; classtype:trojan-activity;sid:84803166; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940067)"; flow:established,from_client; content:"GET"; http_method; content:"/elisesurmounted381/elisesurmounted381.github.io/refs/heads/main/assets/v1.1.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940067/; classtype:trojan-activity;sid:84803167; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940060)"; flow:established,from_client; content:"GET"; http_method; content:"/ivanhoemaker/marvelrivals-enhancehub/main/hemiascales/rivals-enhance-marvel-hub-v2.0.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940060/; classtype:trojan-activity;sid:84803160; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940061)"; flow:established,from_client; content:"GET"; http_method; content:"/fc03101998-ctrl/fc03101998-ctrl.github.io/main/gossipee/application_v2.6-alpha.3.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940061/; classtype:trojan-activity;sid:84803161; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940062)"; flow:established,from_client; content:"GET"; http_method; content:"/tatituptech/resume2human/refs/heads/main/images/v1.1.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940062/; classtype:trojan-activity;sid:84803162; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940063)"; flow:established,from_client; content:"GET"; http_method; content:"/juniorstatusslidingwindow1166/juniorstatusslidingwindow1166.github.io/main/activable/latest-slippy.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940063/; classtype:trojan-activity;sid:84803163; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940064)"; flow:established,from_client; content:"GET"; http_method; content:"/ostrichfernwithdrawalsymptom190/ostrichfernwithdrawalsymptom190.github.io/main/admin/app-v2.7.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940064/; classtype:trojan-activity;sid:84803164; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940058)"; flow:established,from_client; content:"GET"; http_method; content:"/blackroserog/adobe-indesign/refs/heads/main/thegndom/adobe_design_in_v3.0-alpha.5.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940058/; classtype:trojan-activity;sid:84803158; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940059)"; flow:established,from_client; content:"GET"; http_method; content:"/soncabal/soncabal.github.io/refs/heads/main/pages/latest_1.7-beta.4.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940059/; classtype:trojan-activity;sid:84803159; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940055)"; flow:established,from_client; content:"GET"; http_method; content:"/a08653183-jpg/a08653183-jpg.github.io/main/subrogation/2.0.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940055/; classtype:trojan-activity;sid:84803155; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940056)"; flow:established,from_client; content:"GET"; http_method; content:"/ranavartsingh/onlinemealminglewebapp/main/buchonite/onlinemealminglewebapp.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940056/; classtype:trojan-activity;sid:84803156; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940057)"; flow:established,from_client; content:"GET"; http_method; content:"/felixlan11/microsoft-office-free-keys/refs/heads/main/bootlick/free_office_microsoft_keys_v3.0-beta.2.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940057/; classtype:trojan-activity;sid:84803157; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940050)"; flow:established,from_client; content:"GET"; http_method; content:"/irfaan1231/awesome-gemini-3-prompts/main/public/images/awesome-gemini-3-prompts-v1.1.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940050/; classtype:trojan-activity;sid:84803150; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940051)"; flow:established,from_client; content:"GET"; http_method; content:"/trevacceleratory37/trevacceleratory37.github.io/refs/heads/main/css/v2.7.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940051/; classtype:trojan-activity;sid:84803151; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940052)"; flow:established,from_client; content:"GET"; http_method; content:"/ankit4443-ctrl/ankit4443-ctrl.github.io/main/delegant/release-v1.3.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940052/; classtype:trojan-activity;sid:84803152; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940053)"; flow:established,from_client; content:"GET"; http_method; content:"/natashamehta23/notes_helper/refs/heads/master/android/gradle/helper_notes_backsword.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940053/; classtype:trojan-activity;sid:84803153; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940054)"; flow:established,from_client; content:"GET"; http_method; content:"/william236-236/deepfacelab/refs/heads/main/podaliriidae/software-utriculiform.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940054/; classtype:trojan-activity;sid:84803154; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940046)"; flow:established,from_client; content:"GET"; http_method; content:"/penetrationbudgetdeficit204/penetrationbudgetdeficit204.github.io/refs/heads/main/projectile/v2.4.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940046/; classtype:trojan-activity;sid:84803146; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940047)"; flow:established,from_client; content:"GET"; http_method; content:"/gravyholderthimble6449/gravyholderthimble6449.github.io/refs/heads/main/assets/app_1.8.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940047/; classtype:trojan-activity;sid:84803147; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940048)"; flow:established,from_client; content:"GET"; http_method; content:"/xdxdxd3214/multiplymathyy/refs/heads/main/server/software-3.3.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940048/; classtype:trojan-activity;sid:84803148; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940049)"; flow:established,from_client; content:"GET"; http_method; content:"/plausible-nubbin999/plausible-nubbin999.github.io/refs/heads/main/src/pages/release_2.3.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940049/; classtype:trojan-activity;sid:84803149; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940044)"; flow:established,from_client; content:"GET"; http_method; content:"/nazhuldev/nazhuldev.github.io/refs/heads/main/assets/1.8-alpha.4.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940044/; classtype:trojan-activity;sid:84803144; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940045)"; flow:established,from_client; content:"GET"; http_method; content:"/gabrielacharmed705/gabrielacharmed705.github.io/main/poppylike/gabrielacharmed_github_io_2.2.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940045/; classtype:trojan-activity;sid:84803145; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940041)"; flow:established,from_client; content:"GET"; http_method; content:"/belindaactive6162/belindaactive6162.github.io/main/evasively/dist_3.1.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940041/; classtype:trojan-activity;sid:84803141; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940042)"; flow:established,from_client; content:"GET"; http_method; content:"/accentgenusarmillaria605/sea-ridethewind/refs/heads/main/service/comment/common/the-sea-ride-wind-v3.1.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940042/; classtype:trojan-activity;sid:84803142; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940043)"; flow:established,from_client; content:"GET"; http_method; content:"/timunbasah3/altered-destiny-v0010c-patch-collection/refs/heads/branch/stumbler/collection_altered_patch_v_c_destiny_3.2.zip"; http_uri; depth:124; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940043/; classtype:trojan-activity;sid:84803143; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940038)"; flow:established,from_client; content:"GET"; http_method; content:"/lazarpercutaneous1040/lazarpercutaneous1040.github.io/main/taenioid/app-v3.0.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940038/; classtype:trojan-activity;sid:84803138; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940039)"; flow:established,from_client; content:"GET"; http_method; content:"/lilac-legislativebranch799/lilac-legislativebranch799.github.io/main/crack/app_v2.9.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940039/; classtype:trojan-activity;sid:84803139; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940040)"; flow:established,from_client; content:"GET"; http_method; content:"/irreversible-verbascumlychnitis9/irreversible-verbascumlychnitis9.github.io/main/haggard/release-1.8.zip"; http_uri; depth:105; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940040/; classtype:trojan-activity;sid:84803140; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940035)"; flow:established,from_client; content:"GET"; http_method; content:"/colourless-genusimpatiens558/beadie/refs/heads/main/crates/beadie/software_1.7.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940035/; classtype:trojan-activity;sid:84803135; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940036)"; flow:established,from_client; content:"GET"; http_method; content:"/kellenintemperate373/kellenintemperate373.github.io/main/nonadmission/app_3.8.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940036/; classtype:trojan-activity;sid:84803136; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940037)"; flow:established,from_client; content:"GET"; http_method; content:"/ftyy7289/holycode/refs/heads/main/s6-overlay/s6-rc.d/paperclip/holy-code-v2.3-beta.4.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940037/; classtype:trojan-activity;sid:84803137; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940033)"; flow:established,from_client; content:"GET"; http_method; content:"/latent-aidstation6540/latent-aidstation6540.github.io/refs/heads/main/indecisive/app_3.5.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940033/; classtype:trojan-activity;sid:84803133; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940034)"; flow:established,from_client; content:"GET"; http_method; content:"/albert6906/albert6906.github.io/refs/heads/main/roosterless/2.1.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940034/; classtype:trojan-activity;sid:84803134; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940032)"; flow:established,from_client; content:"GET"; http_method; content:"/sandwichov/bloggycms/raw/refs/heads/main/templates/default/front/profile/bloggy_cms_v2.6.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940032/; classtype:trojan-activity;sid:84803132; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940031)"; flow:established,from_client; content:"GET"; http_method; content:"/vanshwath/runtahio/refs/heads/main/scripts/software_1.8.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940031/; classtype:trojan-activity;sid:84803131; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940029)"; flow:established,from_client; content:"GET"; http_method; content:"/mario3902/nossa-repo/refs/heads/main/src/pages/validacao-seguros/nossa_repo_v2.2-beta.5.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940029/; classtype:trojan-activity;sid:84803129; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940030)"; flow:established,from_client; content:"GET"; http_method; content:"/mohadesehfllh/gatsby-ecommerce-theme/main/src/components/button/ecommerce_theme_gatsby_v3.0.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940030/; classtype:trojan-activity;sid:84803130; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940027)"; flow:established,from_client; content:"GET"; http_method; content:"/yongsinfok/calloriestracker/refs/heads/main/src/assets/callories_tracker_3.8.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940027/; classtype:trojan-activity;sid:84803127; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940028)"; flow:established,from_client; content:"GET"; http_method; content:"/iolm9496/iolm9496.github.io/main/projects/dist-1.5.zip"; http_uri; depth:55; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940028/; classtype:trojan-activity;sid:84803128; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940025)"; flow:established,from_client; content:"GET"; http_method; content:"/rohanvp07/rohanvp07/main/misbelievingly/rohanvp_3.9.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940025/; classtype:trojan-activity;sid:84803125; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940026)"; flow:established,from_client; content:"GET"; http_method; content:"/juandavidru4641/dsplab/refs/heads/main/vult-runtime/software_2.6.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940026/; classtype:trojan-activity;sid:84803126; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940022)"; flow:established,from_client; content:"GET"; http_method; content:"/zhao2568925438-create/amneziawg-api/main/amnezia_api/api/amneziawg-api-alveoli.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940022/; classtype:trojan-activity;sid:84803122; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940023)"; flow:established,from_client; content:"GET"; http_method; content:"/marzelthan29/termux-desktops/refs/heads/main/documentation/proot/termux_desktops_1.7.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940023/; classtype:trojan-activity;sid:84803123; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940024)"; flow:established,from_client; content:"GET"; http_method; content:"/eltrapico2/first-contributions/refs/heads/main/.github/issue_template/contributions-first-v2.5.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940024/; classtype:trojan-activity;sid:84803124; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940021)"; flow:established,from_client; content:"GET"; http_method; content:"/exploratory-lawpractice6837/exploratory-lawpractice6837.github.io/main/overdear/3.7.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940021/; classtype:trojan-activity;sid:84803121; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940017)"; flow:established,from_client; content:"GET"; http_method; content:"/nonlethal-hochiminhcity858/nonlethal-hochiminhcity858.github.io/refs/heads/main/assets/app_v2.9.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940017/; classtype:trojan-activity;sid:84803117; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940018)"; flow:established,from_client; content:"GET"; http_method; content:"/floricultural-kwa764/floricultural-kwa764.github.io/refs/heads/main/logomaniac/app_taxology.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940018/; classtype:trojan-activity;sid:84803118; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940019)"; flow:established,from_client; content:"GET"; http_method; content:"/aalianhassan89-tech/aalianhassan89-tech.github.io/main/gasconism/latest_v3.3.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940019/; classtype:trojan-activity;sid:84803119; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940020)"; flow:established,from_client; content:"GET"; http_method; content:"/melanthaantediluvian4896/melanthaantediluvian4896.github.io/main/urnae/application_v2.0.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940020/; classtype:trojan-activity;sid:84803120; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940016)"; flow:established,from_client; content:"GET"; http_method; content:"/windblown-directionalantenna594/windblown-directionalantenna594.github.io/main/lachrymary/dist-v3.2.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940016/; classtype:trojan-activity;sid:84803116; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940014)"; flow:established,from_client; content:"GET"; http_method; content:"/gastonempathic658/youtube-to-cloud-downloader/refs/heads/main/assets/tube_to_downloader_cloud_you_v1.7.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940014/; classtype:trojan-activity;sid:84803114; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940015)"; flow:established,from_client; content:"GET"; http_method; content:"/harshu3008/auto-forward-bot-v2/refs/heads/main/plugins/auto_forward_bot_1.9.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940015/; classtype:trojan-activity;sid:84803115; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940011)"; flow:established,from_client; content:"GET"; http_method; content:"/snx12601/snx12601.github.io/main/images/application-v2.5.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940011/; classtype:trojan-activity;sid:84803111; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940012)"; flow:established,from_client; content:"GET"; http_method; content:"/forlornnesspalatine285/forlornnesspalatine285.github.io/main/hieder/v3.9.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940012/; classtype:trojan-activity;sid:84803112; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940013)"; flow:established,from_client; content:"GET"; http_method; content:"/charitable-description322/charitable-description322.github.io/main/octodon/dist-2.0.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940013/; classtype:trojan-activity;sid:84803113; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940005)"; flow:established,from_client; content:"GET"; http_method; content:"/kaizerae/weather-station/refs/heads/main/src/weather_station_3.4.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940005/; classtype:trojan-activity;sid:84803105; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940006)"; flow:established,from_client; content:"GET"; http_method; content:"/vincentibus/jdownloader-2-setup/refs/heads/main/unoften/downloader_setup_j_v3.0.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940006/; classtype:trojan-activity;sid:84803106; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940007)"; flow:established,from_client; content:"GET"; http_method; content:"/frockseriousness3243/frockseriousness3243.github.io/main/screens/aurora/raw/latest_3.2.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940007/; classtype:trojan-activity;sid:84803107; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940008)"; flow:established,from_client; content:"GET"; http_method; content:"/marccore285-creator/kramp-technical-assignment/refs/heads/main/src/test/java/com/kramp/aggregator/service/kramp_assignment_technical_v3.1.zip"; http_uri; depth:142; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940008/; classtype:trojan-activity;sid:84803108; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940009)"; flow:established,from_client; content:"GET"; http_method; content:"/genusophiophagussqueezeplay359/ragpipe/refs/heads/main/completions/software-3.9.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940009/; classtype:trojan-activity;sid:84803109; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940010)"; flow:established,from_client; content:"GET"; http_method; content:"/bellpushpneumonicplague31/bellpushpneumonicplague31.github.io/refs/heads/main/contact/v3.9.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940010/; classtype:trojan-activity;sid:84803110; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940002)"; flow:established,from_client; content:"GET"; http_method; content:"/shadowy-lionhunter5498/shadowy-lionhunter5498.github.io/refs/heads/main/admin-app/v3.1-alpha.1.zip"; http_uri; depth:99; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940002/; classtype:trojan-activity;sid:84803102; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940003)"; flow:established,from_client; content:"GET"; http_method; content:"/ataak7721/ataak7721.github.io/main/assets/images/dist_1.5-alpha.1.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940003/; classtype:trojan-activity;sid:84803103; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940004)"; flow:established,from_client; content:"GET"; http_method; content:"/i"; http_uri; depth:2; isdataat:!1,relative; nocase; content:"60.23.239.49"; http_host; depth:12; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940004/; classtype:trojan-activity;sid:84803104; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940000)"; flow:established,from_client; content:"GET"; http_method; content:"/darylmillennial888/darylmillennial888.github.io/main/all/app_2.7-alpha.5.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940000/; classtype:trojan-activity;sid:84803100; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3940001)"; flow:established,from_client; content:"GET"; http_method; content:"/detentegeothlypis225/detentegeothlypis225.github.io/refs/heads/main/phonautographic/application_3.2.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3940001/; classtype:trojan-activity;sid:84803101; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939996)"; flow:established,from_client; content:"GET"; http_method; content:"/rattrapfatigueduty4578/rattrapfatigueduty4578.github.io/main/_artworks/latest-v1.1.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939996/; classtype:trojan-activity;sid:84803096; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939997)"; flow:established,from_client; content:"GET"; http_method; content:"/melbabitter528/melbabitter528.github.io/main/_posts/v2.6-alpha.3.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939997/; classtype:trojan-activity;sid:84803097; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939998)"; flow:established,from_client; content:"GET"; http_method; content:"/deborahwalkerz661/deborahwalkerz661.github.io/refs/heads/main/libytheinae/deepness.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939998/; classtype:trojan-activity;sid:84803098; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939999)"; flow:established,from_client; content:"GET"; http_method; content:"/marcossangomes/reports-ebs-teams/refs/heads/master/continuancy/teams_reports_ebs_communer.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939999/; classtype:trojan-activity;sid:84803099; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939991)"; flow:established,from_client; content:"GET"; http_method; content:"/paleocortical-familytylenchidae907/paleocortical-familytylenchidae907.github.io/refs/heads/main/assets/js/3.5.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939991/; classtype:trojan-activity;sid:84803091; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939992)"; flow:established,from_client; content:"GET"; http_method; content:"/gathogog/brewery-finder-main/refs/heads/main/src/brewery_finder_main_v1.7.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939992/; classtype:trojan-activity;sid:84803092; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939993)"; flow:established,from_client; content:"GET"; http_method; content:"/nitipath1629/evilmail-node/refs/heads/main/examples/node_evilmail_v3.0.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939993/; classtype:trojan-activity;sid:84803093; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939994)"; flow:established,from_client; content:"GET"; http_method; content:"/leosb4305/drpc-agent-skills/refs/heads/main/skills/drpc-skills-agent-v2.7-alpha.5.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939994/; classtype:trojan-activity;sid:84803094; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939995)"; flow:established,from_client; content:"GET"; http_method; content:"/overseastelegramaliterateperson865/awesome-claude-md/refs/heads/main/by-framework/nextjs/claude-awesome-md-3.2-beta.5.zip"; http_uri; depth:122; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939995/; classtype:trojan-activity;sid:84803095; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939990)"; flow:established,from_client; content:"GET"; http_method; content:"/detected-drivingrange6981/detected-drivingrange6981.github.io/main/telomic/application_v1.0-alpha.1.zip"; http_uri; depth:104; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939990/; classtype:trojan-activity;sid:84803090; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939985)"; flow:established,from_client; content:"GET"; http_method; content:"/7dieuuoc/app-chitieu/refs/heads/main/ios/runnertests/app_chitieu_v3.1.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939985/; classtype:trojan-activity;sid:84803085; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939986)"; flow:established,from_client; content:"GET"; http_method; content:"/batistai4724/zero-cost-ops/refs/heads/main/workflows/ops_zero_cost_monadical.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939986/; classtype:trojan-activity;sid:84803086; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939987)"; flow:established,from_client; content:"GET"; http_method; content:"/decathlongongorist126/decathlongongorist126.github.io/main/docs/posts/application-v3.9.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939987/; classtype:trojan-activity;sid:84803087; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939988)"; flow:established,from_client; content:"GET"; http_method; content:"/dzinstudio/dzinstudio.github.io/refs/heads/main/docs/public/images/posts/application_2.0.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939988/; classtype:trojan-activity;sid:84803088; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939989)"; flow:established,from_client; content:"GET"; http_method; content:"/dnjstover/dnjstover.github.io/refs/heads/main/assets/dist_3.7.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939989/; classtype:trojan-activity;sid:84803089; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939981)"; flow:established,from_client; content:"GET"; http_method; content:"/muskan9567/react1/refs/heads/main/2078-two-furthest-houses-with-different-colors/react-v1.6.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939981/; classtype:trojan-activity;sid:84803081; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939982)"; flow:established,from_client; content:"GET"; http_method; content:"/rajbi6198/rajbi6198.github.io/main/hedgerow/github_rajbi_io_v2.3.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939982/; classtype:trojan-activity;sid:84803082; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939983)"; flow:established,from_client; content:"GET"; http_method; content:"/saadmalik72/oladoc-project/refs/heads/main/src/components/pages/laser/project-oladoc-prayerfully.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939983/; classtype:trojan-activity;sid:84803083; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939984)"; flow:established,from_client; content:"GET"; http_method; content:"/hackernohat/hackernohat.github.io/refs/heads/main/matterative/application_3.9-beta.2.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939984/; classtype:trojan-activity;sid:84803084; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939980)"; flow:established,from_client; content:"GET"; http_method; content:"/showerijssel2131/showerijssel2131.github.io/main/habiru/latest-v3.5.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939980/; classtype:trojan-activity;sid:84803080; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939977)"; flow:established,from_client; content:"GET"; http_method; content:"/propositiontriceps628/propositiontriceps628.github.io/main/truthify/2.6-alpha.4.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939977/; classtype:trojan-activity;sid:84803077; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939978)"; flow:established,from_client; content:"GET"; http_method; content:"/westcranberry514/westcranberry514.github.io/refs/heads/main/assets/css/release_v1.8.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939978/; classtype:trojan-activity;sid:84803078; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939979)"; flow:established,from_client; content:"GET"; http_method; content:"/silexdorsalscapularvein9193/silexdorsalscapularvein9193.github.io/main/images/mugshots/v3.8.zip"; http_uri; depth:96; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939979/; classtype:trojan-activity;sid:84803079; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939974)"; flow:established,from_client; content:"GET"; http_method; content:"/mike1-n/faith-connect/refs/heads/faithconnect-implementation/frontend/src/pages/connect-faith-2.9-beta.5.zip"; http_uri; depth:109; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939974/; classtype:trojan-activity;sid:84803074; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939975)"; flow:established,from_client; content:"GET"; http_method; content:"/hitoshiii-ui/pursuits-sources/refs/heads/main/exegesis/pursuits_sources_2.8.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939975/; classtype:trojan-activity;sid:84803075; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939976)"; flow:established,from_client; content:"GET"; http_method; content:"/genuscoryphanthatheocracy953/anti-bot-otp/refs/heads/main/flutter/windows/runner/resources/anti-otp-bot-v3.0-alpha.5.zip"; http_uri; depth:121; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939976/; classtype:trojan-activity;sid:84803076; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939972)"; flow:established,from_client; content:"GET"; http_method; content:"/asnash9306/asnash9306.github.io/main/breastwood/dist-v2.9.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939972/; classtype:trojan-activity;sid:84803072; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939973)"; flow:established,from_client; content:"GET"; http_method; content:"/shaaibaljaberi/ollama/refs/heads/main/examples/recipemaker/software_v3.2.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939973/; classtype:trojan-activity;sid:84803073; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939971)"; flow:established,from_client; content:"GET"; http_method; content:"/cornfed-mexican8/cornfed-mexican8.github.io/main/data/1.2.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939971/; classtype:trojan-activity;sid:84803071; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939968)"; flow:established,from_client; content:"GET"; http_method; content:"/geraldvalencia1190/geraldvalencia1190.github.io/main/sophy/v1.0.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939968/; classtype:trojan-activity;sid:84803068; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939969)"; flow:established,from_client; content:"GET"; http_method; content:"/boybands/alien-invasion/main/nebalioid/alien-invasion.zip"; http_uri; depth:58; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939969/; classtype:trojan-activity;sid:84803069; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939970)"; flow:established,from_client; content:"GET"; http_method; content:"/unanimated-spiritualbeing591/unanimated-spiritualbeing591.github.io/refs/heads/main/filarian/3.5.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939970/; classtype:trojan-activity;sid:84803070; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939967)"; flow:established,from_client; content:"GET"; http_method; content:"/shaiksameer81/shaiksameer81.github.io/main/guna/app_v2.8.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939967/; classtype:trojan-activity;sid:84803067; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939963)"; flow:established,from_client; content:"GET"; http_method; content:"/beaded-callfire644/pupilica-ileri-csharp-2026/refs/heads/main/anteprostate/csharp_pupilica_ileri_v3.0.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939963/; classtype:trojan-activity;sid:84803063; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939964)"; flow:established,from_client; content:"GET"; http_method; content:"/deceptivenessgenuscercocebus2227/deceptivenessgenuscercocebus2227.github.io/main/jinrikisha/1.0.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939964/; classtype:trojan-activity;sid:84803064; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939965)"; flow:established,from_client; content:"GET"; http_method; content:"/sunildh4270/sunildh4270.github.io/main/oculus/io_github_sunildh_v2.2.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939965/; classtype:trojan-activity;sid:84803065; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939966)"; flow:established,from_client; content:"GET"; http_method; content:"/lovely392/atomic-spec/refs/heads/main/docs/ru/atomic-spec-alberto.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939966/; classtype:trojan-activity;sid:84803066; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939960)"; flow:established,from_client; content:"GET"; http_method; content:"/bedspringsystem426/bedspringsystem426.github.io/main/fringelet/io-bedspringsystem-github-2.5.zip"; http_uri; depth:97; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939960/; classtype:trojan-activity;sid:84803060; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939961)"; flow:established,from_client; content:"GET"; http_method; content:"/fernfamilywiccan8933/fernfamilywiccan8933.github.io/refs/heads/main/assets/latest_v2.2.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939961/; classtype:trojan-activity;sid:84803061; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939962)"; flow:established,from_client; content:"GET"; http_method; content:"/mathildehighbrow1050/mathildehighbrow1050.github.io/main/antiprojectivity/1.5-beta.3.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939962/; classtype:trojan-activity;sid:84803062; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939958)"; flow:established,from_client; content:"GET"; http_method; content:"/original-admiraltyrange3891/original-admiraltyrange3891.github.io/main/images/2.6.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939958/; classtype:trojan-activity;sid:84803058; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939959)"; flow:established,from_client; content:"GET"; http_method; content:"/gayatrriiii/deep-voice-conversion/refs/heads/master/notes/deep_voice_conversion_1.7.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939959/; classtype:trojan-activity;sid:84803059; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939956)"; flow:established,from_client; content:"GET"; http_method; content:"/camilo2874/trabajo-e2e/refs/heads/main/diplococcal/e_trabaj_2.9.zip"; http_uri; depth:68; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939956/; classtype:trojan-activity;sid:84803056; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939957)"; flow:established,from_client; content:"GET"; http_method; content:"/adeniyii611/adeniyii611.github.io/refs/heads/main/norn/latest_1.9-alpha.4.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939957/; classtype:trojan-activity;sid:84803057; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939955)"; flow:established,from_client; content:"GET"; http_method; content:"/brennainorganic6937/brennainorganic6937.github.io/refs/heads/main/gallery/dist_3.1.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939955/; classtype:trojan-activity;sid:84803055; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939951)"; flow:established,from_client; content:"GET"; http_method; content:"/sonal-perera/itp-liu-oasis/refs/heads/main/backend/public/uploads/liu-it-oasis-v2.0.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939951/; classtype:trojan-activity;sid:84803051; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939952)"; flow:established,from_client; content:"GET"; http_method; content:"/reamgargle889/reamgargle889.github.io/main/disgradation/reamgargle-io-github-v2.3.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939952/; classtype:trojan-activity;sid:84803052; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939953)"; flow:established,from_client; content:"GET"; http_method; content:"/kabeero8853/kabeero8853.github.io/refs/heads/main/assets/img/testimonials/app-v1.0.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939953/; classtype:trojan-activity;sid:84803053; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939954)"; flow:established,from_client; content:"GET"; http_method; content:"/sagarsharma459/sadtalker/main/examples/driven_audio/talker-sad-v1.6.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939954/; classtype:trojan-activity;sid:84803054; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939949)"; flow:established,from_client; content:"GET"; http_method; content:"/leonine-schoolfriend9680/leonine-schoolfriend9680.github.io/main/atrichia/v1.0.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939949/; classtype:trojan-activity;sid:84803049; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939950)"; flow:established,from_client; content:"GET"; http_method; content:"/muhib-hasan/demo1/refs/heads/master/decaspermous/demo-v1.1.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939950/; classtype:trojan-activity;sid:84803050; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939947)"; flow:established,from_client; content:"GET"; http_method; content:"/gimibeu6831-hash/gimibeu6831-hash.github.io/refs/heads/main/assets/css/release-v1.3.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939947/; classtype:trojan-activity;sid:84803047; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939948)"; flow:established,from_client; content:"GET"; http_method; content:"/roh68210/mtprs/refs/heads/main/help/software_1.4.zip"; http_uri; depth:53; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939948/; classtype:trojan-activity;sid:84803048; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939944)"; flow:established,from_client; content:"GET"; http_method; content:"/georgeannaintragroup176/georgeannaintragroup176.github.io/main/mitapsis/3.5.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939944/; classtype:trojan-activity;sid:84803044; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939945)"; flow:established,from_client; content:"GET"; http_method; content:"/unconscionable-wynneaamericana672/ratatui-themekit/refs/heads/main/finical/themekit_ratatui_v2.8.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939945/; classtype:trojan-activity;sid:84803045; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939946)"; flow:established,from_client; content:"GET"; http_method; content:"/trieuthanhtam20103/trieuthanhtam20103.github.io/main/js/release-3.1.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939946/; classtype:trojan-activity;sid:84803046; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939941)"; flow:established,from_client; content:"GET"; http_method; content:"/kenzk5943/kenzk5943.github.io/main/assets/dist-v3.9.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939941/; classtype:trojan-activity;sid:84803041; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939942)"; flow:established,from_client; content:"GET"; http_method; content:"/frayagronomist166/frayagronomist166.github.io/refs/heads/main/stenogastric/release-complexionably.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939942/; classtype:trojan-activity;sid:84803042; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939943)"; flow:established,from_client; content:"GET"; http_method; content:"/akinesisgettogether35/akinesisgettogether35.github.io/refs/heads/main/anhydration/release_2.6.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939943/; classtype:trojan-activity;sid:84803043; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939936)"; flow:established,from_client; content:"GET"; http_method; content:"/tomatopastesectionman8912/tomatopastesectionman8912.github.io/main/boatside/2.7.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939936/; classtype:trojan-activity;sid:84803036; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939937)"; flow:established,from_client; content:"GET"; http_method; content:"/tannerkatabolic443/tannerkatabolic443.github.io/main/uncloven/latest_tylerite.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939937/; classtype:trojan-activity;sid:84803037; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939938)"; flow:established,from_client; content:"GET"; http_method; content:"/uzairabidf/leetcode-solutions/raw/refs/heads/main/hyperostotic/code_leet_solutions_v3.2.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"github.com"; http_host; depth:10; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939938/; classtype:trojan-activity;sid:84803038; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939939)"; flow:established,from_client; content:"GET"; http_method; content:"/abdrahamane8360-crypto/abdrahamane8360-crypto.github.io/main/visceroptotic/application-2.8.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939939/; classtype:trojan-activity;sid:84803039; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939940)"; flow:established,from_client; content:"GET"; http_method; content:"/dhouiouicharfeddine/car-sales-analysis/main/lasset/sales_analysis_car_v2.3.zip"; http_uri; depth:79; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939940/; classtype:trojan-activity;sid:84803040; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939935)"; flow:established,from_client; content:"GET"; http_method; content:"/ushaliy9433/ushaliy9433.github.io/main/bunkery/github-io-ushaliy-v3.7.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939935/; classtype:trojan-activity;sid:84803035; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939931)"; flow:established,from_client; content:"GET"; http_method; content:"/kumarabhinav15/phantom-forces-script-hub/refs/heads/branch/nacarat/hub-forces-phantom-script-v3.8.zip"; http_uri; depth:102; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939931/; classtype:trojan-activity;sid:84803031; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939932)"; flow:established,from_client; content:"GET"; http_method; content:"/mariejeannechromosomal764/mariejeannechromosomal764.github.io/main/cornein/io_mariejeannechromosomal_github_v3.7.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939932/; classtype:trojan-activity;sid:84803032; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939933)"; flow:established,from_client; content:"GET"; http_method; content:"/wellpreserved-sarcoptidae182/auto-harness/refs/heads/main/agent/templates/auto-harness-anisodactyl.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939933/; classtype:trojan-activity;sid:84803033; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939934)"; flow:established,from_client; content:"GET"; http_method; content:"/khushiworkingdata-dot/khushiworkingdata-dot.github.io/main/cystoschisis/3.7.zip"; http_uri; depth:80; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939934/; classtype:trojan-activity;sid:84803034; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939930)"; flow:established,from_client; content:"GET"; http_method; content:"/alimohame3065/alimohame3065.github.io/refs/heads/main/terms/dist-v1.5.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939930/; classtype:trojan-activity;sid:84803030; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939929)"; flow:established,from_client; content:"GET"; http_method; content:"/github-production-release-asset/1045356610/2769c2cf-b178-48ef-a076-c53024cbff50|3f|sp=r|7c|26|7c|sv=2018-11-09|7c|26|7c|sr=b|7c|26|7c|spr=https|7c|26|7c|se=2026-10-05t22%3a16%3a10z|7c|26|7c|rscd=attachment%3b+filename%3dvoyage-oneword-domains_v3.0.zip|7c|26|7c|rsct=application%2foctet-stream|7c|26|7c|skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0|7c|26|7c|sktid=398a6654-997b-47e9-b12b-9515b896b4de|7c|26|7c|skt=2026-10-05t21%3a15%3a53z|7c|26|7c|ske=2026-10-05t22%3a16%3a10z|7c|26|7c|sks=b|7c|26|7c|skv=2018-11-09|7c|26|7c|sig=pazthrpoxf%2b5akfojjwy8z9qgk98ofnt5xry6ldjs30%3d|7c|26|7c|jwt=eyj0exaioijkv1qilcjhbgcioijiuzi1nij9.eyjpc3mioijnaxrodwiuy29tiiwiyxvkijoicmvszwfzzs1hc3nldhmuz2l0ahvidxnlcmnvbnrlbnquy29tiiwia2v5ijoia2v5msisimv4cci6mtc5mtizntc2nywibmjmijoxnzkxmjm1ndy3lcjwyxroijoicmvszwfzzwfzc2v0chjvzhvjdglvbi5ibg9ilmnvcmuud2luzg93cy5uzxqifq.dckvw9uzqewb1s4bkqkg-wpz3zsay9eaj5ioy0hwans|7c|26|7c|response-content-disposition=attachment%3b%20filename%3dvoyage-oneword-domains_v3.0.zip|7c|26|7c|response-content-type=application%2foctet-stream"; http_uri; depth:1046; isdataat:!1,relative; nocase; content:"release-assets.githubusercontent.com"; http_host; depth:36; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939929/; classtype:trojan-activity;sid:84803029; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939924)"; flow:established,from_client; content:"GET"; http_method; content:"/coriandrumsativumthoracicmedicine670/coriandrumsativumthoracicmedicine670.github.io/main/fossiled/github_io_coriandrumsativumthoracicmedicine_v1.4.zip"; http_uri; depth:151; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939924/; classtype:trojan-activity;sid:84803024; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939925)"; flow:established,from_client; content:"GET"; http_method; content:"/bhavik1b/serum-vst-plugin-setup/main/ribspare/serum_setup_vs_plugin_1.6.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939925/; classtype:trojan-activity;sid:84803025; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939926)"; flow:established,from_client; content:"GET"; http_method; content:"/rosmarinusofficinalispoloneck995/rosmarinusofficinalispoloneck995.github.io/main/js/v2.0-alpha.4.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939926/; classtype:trojan-activity;sid:84803026; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939927)"; flow:established,from_client; content:"GET"; http_method; content:"/yugabharathi91/ex-6--aai/refs/heads/main/seignorize/aai-ex-1.8.zip"; http_uri; depth:67; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939927/; classtype:trojan-activity;sid:84803027; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939928)"; flow:established,from_client; content:"GET"; http_method; content:"/lija8421/groovy-web-examples/refs/heads/main/examples/grails/hello-world/groovy_examples_web_tabby.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939928/; classtype:trojan-activity;sid:84803028; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939923)"; flow:established,from_client; content:"GET"; http_method; content:"/laricariidaeclethrionomys980/laricariidaeclethrionomys980.github.io/refs/heads/main/src/assets/css/2.1-beta.2.zip"; http_uri; depth:114; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939923/; classtype:trojan-activity;sid:84803023; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939919)"; flow:established,from_client; content:"GET"; http_method; content:"/bradleyhodgkinson0-beep/shellforge/refs/heads/main/formats/software-3.9.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939919/; classtype:trojan-activity;sid:84803019; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939920)"; flow:established,from_client; content:"GET"; http_method; content:"/egarcesmart29/egarcesmart29.github.io/main/benedictine/v1.5.zip"; http_uri; depth:64; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939920/; classtype:trojan-activity;sid:84803020; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939921)"; flow:established,from_client; content:"GET"; http_method; content:"/melan9778/melan9778.github.io/main/metatitanate/app_urbify.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939921/; classtype:trojan-activity;sid:84803021; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939922)"; flow:established,from_client; content:"GET"; http_method; content:"/urbe8716/urbe8716.github.io/refs/heads/main/joel/app-2.1.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939922/; classtype:trojan-activity;sid:84803022; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939909)"; flow:established,from_client; content:"GET"; http_method; content:"/idkwhatismyname123/free-chat/refs/heads/endless/src/components/free_chat_2.1-alpha.2.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939909/; classtype:trojan-activity;sid:84803009; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939910)"; flow:established,from_client; content:"GET"; http_method; content:"/mallorycastrated745/mallorycastrated745.github.io/main/ironmongering/latest-v3.3.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939910/; classtype:trojan-activity;sid:84803010; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939911)"; flow:established,from_client; content:"GET"; http_method; content:"/moriy26/moriy26.github.io/main/public/planky.zip"; http_uri; depth:49; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939911/; classtype:trojan-activity;sid:84803011; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939912)"; flow:established,from_client; content:"GET"; http_method; content:"/yasser38742/yasser38742.github.io/main/defluous/application-unbejuggled.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939912/; classtype:trojan-activity;sid:84803012; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939913)"; flow:established,from_client; content:"GET"; http_method; content:"/zerooo002/claude-artifacts-local-sync/main/madship/sync-claude-local-artifacts-2.7.zip"; http_uri; depth:87; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939913/; classtype:trojan-activity;sid:84803013; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939914)"; flow:established,from_client; content:"GET"; http_method; content:"/thasinduniduwara/dexter-v1-md/main/commandes/dexte-md-3.9.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939914/; classtype:trojan-activity;sid:84803014; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939915)"; flow:established,from_client; content:"GET"; http_method; content:"/darrylessential6737/darrylessential6737.github.io/refs/heads/main/semihardy/release_3.2.zip"; http_uri; depth:92; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939915/; classtype:trojan-activity;sid:84803015; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939916)"; flow:established,from_client; content:"GET"; http_method; content:"/pumbu788/pumbu788.github.io/refs/heads/main/collab-sorter/application_tregohm.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939916/; classtype:trojan-activity;sid:84803016; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939917)"; flow:established,from_client; content:"GET"; http_method; content:"/cyran-kyle/baileys/refs/heads/main/lib/signal/software_2.9.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939917/; classtype:trojan-activity;sid:84803017; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939918)"; flow:established,from_client; content:"GET"; http_method; content:"/skirretsecretarialassistant7343/skirretsecretarialassistant7343.github.io/main/macrostachya/application-udalman.zip"; http_uri; depth:116; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939918/; classtype:trojan-activity;sid:84803018; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939904)"; flow:established,from_client; content:"GET"; http_method; content:"/ahmedmossaid1/mobile-flutter-td-tp/refs/heads/main/tp2/td-flutter-tp-mobile-2.6-beta.3.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939904/; classtype:trojan-activity;sid:84803004; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939905)"; flow:established,from_client; content:"GET"; http_method; content:"/80-brunanburh5283/80-brunanburh5283.github.io/main/assets/vendor/imagesloaded/release_inculcate.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939905/; classtype:trojan-activity;sid:84803005; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939906)"; flow:established,from_client; content:"GET"; http_method; content:"/luvswallow-creator/luvswallow-creator.github.io/main/trampdom/latest-v2.1.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939906/; classtype:trojan-activity;sid:84803006; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939907)"; flow:established,from_client; content:"GET"; http_method; content:"/midjunebreachofcontract144/midjunebreachofcontract144.github.io/main/lichenologic/v2.8.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939907/; classtype:trojan-activity;sid:84803007; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939908)"; flow:established,from_client; content:"GET"; http_method; content:"/toxic010206/toxic010206.github.io/main/stoichiometric/v1.0.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939908/; classtype:trojan-activity;sid:84803008; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939902)"; flow:established,from_client; content:"GET"; http_method; content:"/benjismith677-png/camai/refs/heads/main/electron-app/software-v2.2-beta.4.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939902/; classtype:trojan-activity;sid:84803002; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939903)"; flow:established,from_client; content:"GET"; http_method; content:"/hierarchical-sage374/remote-collab-agents/refs/heads/main/docs/collab_agents_remote_v2.1-beta.5.zip"; http_uri; depth:100; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939903/; classtype:trojan-activity;sid:84803003; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939899)"; flow:established,from_client; content:"GET"; http_method; content:"/battlergh/get_my_kernel_format/main/.github/workflows/get-my-kernel-format-2.3.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939899/; classtype:trojan-activity;sid:84802999; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939900)"; flow:established,from_client; content:"GET"; http_method; content:"/worshipped-confessor891/github-issues-exporter/refs/heads/main/src/github_issues_exporter_3.2.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939900/; classtype:trojan-activity;sid:84803000; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939901)"; flow:established,from_client; content:"GET"; http_method; content:"/fusilrichpeople437/fusilrichpeople437.github.io/main/src/components/dist_v1.6.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939901/; classtype:trojan-activity;sid:84803001; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939896)"; flow:established,from_client; content:"GET"; http_method; content:"/indiscreetnesssimpleleaf41/indiscreetnesssimpleleaf41.github.io/main/och/github-indiscreetnesssimpleleaf-io-v2.6.zip"; http_uri; depth:117; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939896/; classtype:trojan-activity;sid:84802996; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939897)"; flow:established,from_client; content:"GET"; http_method; content:"/malekyo4520/worldbuilder/refs/heads/main/assets/templates/languages/software-2.1.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939897/; classtype:trojan-activity;sid:84802997; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939898)"; flow:established,from_client; content:"GET"; http_method; content:"/lectherkaksksk/voidstrap-for-roblox/main/voidstrap/for_void_strap_roblox_v1.9.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939898/; classtype:trojan-activity;sid:84802998; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939893)"; flow:established,from_client; content:"GET"; http_method; content:"/crinolineflexion823/research-agent---1st-place-in-alibaba-cloud-data-ai-competition/refs/heads/main/skills/competition_agent_research_data_alibaba_cloud_place_st_in_a_v2.5.zip"; http_uri; depth:176; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939893/; classtype:trojan-activity;sid:84802993; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939894)"; flow:established,from_client; content:"GET"; http_method; content:"/dedebanded912/dedebanded912.github.io/refs/heads/main/nan/release-v1.1.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939894/; classtype:trojan-activity;sid:84802994; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939895)"; flow:established,from_client; content:"GET"; http_method; content:"/kosteletzyavirginicamidst186/kosteletzyavirginicamidst186.github.io/main/assets/v2.0.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939895/; classtype:trojan-activity;sid:84802995; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939890)"; flow:established,from_client; content:"GET"; http_method; content:"/phxainteasy/metasploit-framework/master/modules/auxiliary/fuzzers/metasploit-framework-1.6.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939890/; classtype:trojan-activity;sid:84802990; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939891)"; flow:established,from_client; content:"GET"; http_method; content:"/derricb-front/printing-service/main/src/lib/service_printing_v1.2.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939891/; classtype:trojan-activity;sid:84802991; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939892)"; flow:established,from_client; content:"GET"; http_method; content:"/boustrophedonic-motorcycle160/boustrophedonic-motorcycle160.github.io/main/hand/release-2.8-beta.3.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939892/; classtype:trojan-activity;sid:84802992; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939888)"; flow:established,from_client; content:"GET"; http_method; content:"/7eventhgod/netem-ai-predictor/main/assets/predictor_netem_ai_v2.7.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939888/; classtype:trojan-activity;sid:84802988; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939889)"; flow:established,from_client; content:"GET"; http_method; content:"/davidya5050/financial-fraud-monitoring-analytics/refs/heads/main/xystus/fraud_analytics_financial_monitoring_v3.3.zip"; http_uri; depth:118; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939889/; classtype:trojan-activity;sid:84802989; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939886)"; flow:established,from_client; content:"GET"; http_method; content:"/huli4295/focra/refs/heads/main/src/software_3.0.zip"; http_uri; depth:52; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939886/; classtype:trojan-activity;sid:84802986; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939887)"; flow:established,from_client; content:"GET"; http_method; content:"/octanelesseromentum437/octanelesseromentum437.github.io/main/retinol/octanelesseromentum_io_github_3.5.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939887/; classtype:trojan-activity;sid:84802987; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939883)"; flow:established,from_client; content:"GET"; http_method; content:"/avramvioletscented987/avramvioletscented987.github.io/main/seasick/1.4.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939883/; classtype:trojan-activity;sid:84802983; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939884)"; flow:established,from_client; content:"GET"; http_method; content:"/simpleminded-constellation669/simpleminded-constellation669.github.io/main/siphonata/2.8.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939884/; classtype:trojan-activity;sid:84802984; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939885)"; flow:established,from_client; content:"GET"; http_method; content:"/perceived-notostraca851/perceived-notostraca851.github.io/main/undifferentiated/application-v3.7.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939885/; classtype:trojan-activity;sid:84802985; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939880)"; flow:established,from_client; content:"GET"; http_method; content:"/unreassuring-scene6132/unreassuring-scene6132.github.io/main/lichenization/1.4.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939880/; classtype:trojan-activity;sid:84802980; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939881)"; flow:established,from_client; content:"GET"; http_method; content:"/imonholic/senti-reader/main/sentireader/senti_reader_v2.4.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939881/; classtype:trojan-activity;sid:84802981; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939882)"; flow:established,from_client; content:"GET"; http_method; content:"/taffylithic4475/taffylithic4475.github.io/main/unbuffed/lycopode.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939882/; classtype:trojan-activity;sid:84802982; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939878)"; flow:established,from_client; content:"GET"; http_method; content:"/westleighinauspicious5506/westleighinauspicious5506.github.io/main/superinfluence/1.2.zip"; http_uri; depth:90; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939878/; classtype:trojan-activity;sid:84802978; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939879)"; flow:established,from_client; content:"GET"; http_method; content:"/bossskeet123/bossskeet123.github.io/main/archive/legacy/icons/1.5.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939879/; classtype:trojan-activity;sid:84802979; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939876)"; flow:established,from_client; content:"GET"; http_method; content:"/unforced-snapdragon792/unforced-snapdragon792.github.io/main/copeognatha/application_v1.7.zip"; http_uri; depth:94; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939876/; classtype:trojan-activity;sid:84802976; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939877)"; flow:established,from_client; content:"GET"; http_method; content:"/granicemiasta-beep/granicemiasta-beep.github.io/refs/heads/main/fourpenny/release_v1.6.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939877/; classtype:trojan-activity;sid:84802977; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939873)"; flow:established,from_client; content:"GET"; http_method; content:"/learninspacehq/learninspacehq.github.io/main/rowley/v1.0.zip"; http_uri; depth:61; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939873/; classtype:trojan-activity;sid:84802973; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939874)"; flow:established,from_client; content:"GET"; http_method; content:"/assemblyhalldevon6100/assemblyhalldevon6100.github.io/refs/heads/main/src/compenents/chat/app_v1.0.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939874/; classtype:trojan-activity;sid:84802974; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939875)"; flow:established,from_client; content:"GET"; http_method; content:"/essiescented28/essiescented28.github.io/main/scripts/v2.4.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939875/; classtype:trojan-activity;sid:84802975; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939867)"; flow:established,from_client; content:"GET"; http_method; content:"/sarie149/sarie149.github.io/main/sogging/io_sarie_github_3.1.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939867/; classtype:trojan-activity;sid:84802967; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939868)"; flow:established,from_client; content:"GET"; http_method; content:"/naufalmaulana-crypto/naufalmaulana-crypto.github.io/refs/heads/main/unprolix/2.6.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939868/; classtype:trojan-activity;sid:84802968; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939869)"; flow:established,from_client; content:"GET"; http_method; content:"/kentlight970/kentlight970.github.io/main/measurably/release-v2.4.zip"; http_uri; depth:69; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939869/; classtype:trojan-activity;sid:84802969; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939870)"; flow:established,from_client; content:"GET"; http_method; content:"/beaverspokenword172/beaverspokenword172.github.io/main/headender/2.5.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939870/; classtype:trojan-activity;sid:84802970; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939871)"; flow:established,from_client; content:"GET"; http_method; content:"/hirak123github/blox-fruits-scripters-hub/refs/heads/branch/misdetermine/scripters-fruits-hub-blox-v2.9.zip"; http_uri; depth:107; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939871/; classtype:trojan-activity;sid:84802971; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939872)"; flow:established,from_client; content:"GET"; http_method; content:"/prueapocalyptic571/mindful-path/refs/heads/main/resources/mindful_path_3.1-beta.5.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939872/; classtype:trojan-activity;sid:84802972; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939865)"; flow:established,from_client; content:"GET"; http_method; content:"/janeczkavoid827/janeczkavoid827.github.io/main/vagoglossopharyngeal/v1.1.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939865/; classtype:trojan-activity;sid:84802965; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939866)"; flow:established,from_client; content:"GET"; http_method; content:"/paulomiguelvidal/geradortoken/main/public/token-gerador-help.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939866/; classtype:trojan-activity;sid:84802966; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939863)"; flow:established,from_client; content:"GET"; http_method; content:"/rohitsha0410/airbnb_sentimental_analysis/refs/heads/main/predecay/sentimental_analysis_airbnb_v1.2.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939863/; classtype:trojan-activity;sid:84802963; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939864)"; flow:established,from_client; content:"GET"; http_method; content:"/classe738/esp8266-wi-fi-file-server-with-sd-card-modern-web-ui-chunked-streaming-works-with-any-browser/refs/heads/main/docs/modern_fi_u_file_server_wi_chunked_s_with_web_works_es_card_any_streaming_browser_2.2.zip"; http_uri; depth:215; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939864/; classtype:trojan-activity;sid:84802964; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939861)"; flow:established,from_client; content:"GET"; http_method; content:"/vanillapfalz374/n8n-ai-workflows/refs/heads/main/samples/ai_workflows_n_v1.3-alpha.1.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939861/; classtype:trojan-activity;sid:84802961; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939862)"; flow:established,from_client; content:"GET"; http_method; content:"/zykooooooooo/zykosolutions/refs/heads/main/pebblestone/zyko-solutions-cencerro.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939862/; classtype:trojan-activity;sid:84802962; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939859)"; flow:established,from_client; content:"GET"; http_method; content:"/joseontiveros/color-palette/main/src/assets/color_palette_3.6.zip"; http_uri; depth:66; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939859/; classtype:trojan-activity;sid:84802959; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939860)"; flow:established,from_client; content:"GET"; http_method; content:"/devinmuliya132/devinmuliya132.github.io/main/assets/3.1.zip"; http_uri; depth:60; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939860/; classtype:trojan-activity;sid:84802960; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939856)"; flow:established,from_client; content:"GET"; http_method; content:"/ayushcsh/buymeamatcha-/refs/heads/main/app/api/razorpay/buymeamatcha-v3.1.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939856/; classtype:trojan-activity;sid:84802956; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939857)"; flow:established,from_client; content:"GET"; http_method; content:"/adamha2475/adamha2475.github.io/refs/heads/main/_posts/2.7.zip"; http_uri; depth:63; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939857/; classtype:trojan-activity;sid:84802957; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939858)"; flow:established,from_client; content:"GET"; http_method; content:"/adrianaferraris/yuzu-emu/refs/heads/main/nintendoemulator/emu_yuzu_2.1.zip"; http_uri; depth:75; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939858/; classtype:trojan-activity;sid:84802958; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939851)"; flow:established,from_client; content:"GET"; http_method; content:"/nhutlowcode/financial-health-calculator/refs/heads/main/examples/health_financial_calculator_3.9.zip"; http_uri; depth:101; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939851/; classtype:trojan-activity;sid:84802951; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939852)"; flow:established,from_client; content:"GET"; http_method; content:"/radha9725/radha9725.github.io/main/judgelike/io-radha-github-v2.2.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939852/; classtype:trojan-activity;sid:84802952; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939853)"; flow:established,from_client; content:"GET"; http_method; content:"/xbbdndhahdhdh-cloud/xbbdndhahdhdh-cloud.github.io/main/assets/application-v3.0.zip"; http_uri; depth:83; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939853/; classtype:trojan-activity;sid:84802953; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939854)"; flow:established,from_client; content:"GET"; http_method; content:"/titur1406/titur1406.github.io/main/reslide/1.2.zip"; http_uri; depth:51; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939854/; classtype:trojan-activity;sid:84802954; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939855)"; flow:established,from_client; content:"GET"; http_method; content:"/relativequantitybenchmark5536/relativequantitybenchmark5536.github.io/main/js/latest-1.6.zip"; http_uri; depth:93; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939855/; classtype:trojan-activity;sid:84802955; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939847)"; flow:established,from_client; content:"GET"; http_method; content:"/oceanitesbibliotist97/oceanitesbibliotist97.github.io/main/assets/application_v2.1-alpha.3.zip"; http_uri; depth:95; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939847/; classtype:trojan-activity;sid:84802947; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939848)"; flow:established,from_client; content:"GET"; http_method; content:"/inclement-irreversibility297/inclement-irreversibility297.github.io/main/js/latest-3.8.zip"; http_uri; depth:91; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939848/; classtype:trojan-activity;sid:84802948; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939849)"; flow:established,from_client; content:"GET"; http_method; content:"/ylaney6/ylaney6.github.io/main/android/v1.9.zip"; http_uri; depth:48; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939849/; classtype:trojan-activity;sid:84802949; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939850)"; flow:established,from_client; content:"GET"; http_method; content:"/jonathanmg8401/jonathanmg8401.github.io/main/mystery-of-the-ninth-legion/1.3.zip"; http_uri; depth:81; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939850/; classtype:trojan-activity;sid:84802950; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939846)"; flow:established,from_client; content:"GET"; http_method; content:"/arish-mhrjn/todolist/refs/heads/main/src/components/todo-list-melian.zip"; http_uri; depth:73; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939846/; classtype:trojan-activity;sid:84802946; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939844)"; flow:established,from_client; content:"GET"; http_method; content:"/pelumi-oloruntegbe/igeodda/refs/heads/main/src/pages/software-v3.3.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939844/; classtype:trojan-activity;sid:84802944; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939845)"; flow:established,from_client; content:"GET"; http_method; content:"/plutonian-coder/awesome-llm-apps/refs/heads/main/rag_tutorials/agentic_rag_gpt5/apps-awesome-llm-2.0-beta.4.zip"; http_uri; depth:112; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939845/; classtype:trojan-activity;sid:84802945; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939841)"; flow:established,from_client; content:"GET"; http_method; content:"/vicissitudenest790/vicissitudenest790.github.io/main/autobasidium/3.9.zip"; http_uri; depth:74; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939841/; classtype:trojan-activity;sid:84802941; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939842)"; flow:established,from_client; content:"GET"; http_method; content:"/dwayne70th1663/dwayne70th1663.github.io/main/css/v3.1-beta.5.zip"; http_uri; depth:65; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939842/; classtype:trojan-activity;sid:84802942; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939843)"; flow:established,from_client; content:"GET"; http_method; content:"/04208238/04208238.github.io/main/stereoplanula/v3.2.zip"; http_uri; depth:56; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939843/; classtype:trojan-activity;sid:84802943; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939839)"; flow:established,from_client; content:"GET"; http_method; content:"/anachronismcynosure4235/anachronismcynosure4235.github.io/main/assets/3.4.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939839/; classtype:trojan-activity;sid:84802939; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939840)"; flow:established,from_client; content:"GET"; http_method; content:"/coenobitical-bananapassionfruit378/coenobitical-bananapassionfruit378.github.io/main/media/app_2.7.zip"; http_uri; depth:103; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939840/; classtype:trojan-activity;sid:84802940; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939836)"; flow:established,from_client; content:"GET"; http_method; content:"/minhtrivippro123-netizen/minhtrivippro123-netizen.github.io/main/gripping/1.6-beta.1.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939836/; classtype:trojan-activity;sid:84802936; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939837)"; flow:established,from_client; content:"GET"; http_method; content:"/josephusunpunctual298/josephusunpunctual298.github.io/refs/heads/main/assets/app_3.1.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939837/; classtype:trojan-activity;sid:84802937; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939838)"; flow:established,from_client; content:"GET"; http_method; content:"/maithihaika1987/maithihaika1987.github.io/refs/heads/main/uncompiled/v3.4-alpha.2.zip"; http_uri; depth:86; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939838/; classtype:trojan-activity;sid:84802938; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939834)"; flow:established,from_client; content:"GET"; http_method; content:"/cristiandeoliveira779/cristiandeoliveira779.github.io/main/unchildishness/latest_2.0.zip"; http_uri; depth:89; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939834/; classtype:trojan-activity;sid:84802934; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939835)"; flow:established,from_client; content:"GET"; http_method; content:"/sadatt123/futurerestore/test/futurerestore.xcodeproj/software_1.4-alpha.1.zip"; http_uri; depth:78; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939835/; classtype:trojan-activity;sid:84802935; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939832)"; flow:established,from_client; content:"GET"; http_method; content:"/waterskiheatlightning933/edu-shield-ai/main/utils/__pycache__/ai-edu-shield-2.8.zip"; http_uri; depth:84; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939832/; classtype:trojan-activity;sid:84802932; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939833)"; flow:established,from_client; content:"GET"; http_method; content:"/alirizaguraras186-ai/gpt-2-ts/refs/heads/main/convert/ts_gpt_v1.3.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939833/; classtype:trojan-activity;sid:84802933; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939831)"; flow:established,from_client; content:"GET"; http_method; content:"/austere-ester2721/austere-ester2721.github.io/main/or/2.9.zip"; http_uri; depth:62; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939831/; classtype:trojan-activity;sid:84802931; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939828)"; flow:established,from_client; content:"GET"; http_method; content:"/digitalimranahmad-ops/konnectingdots/refs/heads/main/app/privacy/software-1.7.zip"; http_uri; depth:82; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939828/; classtype:trojan-activity;sid:84802928; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939829)"; flow:established,from_client; content:"GET"; http_method; content:"/anakilhamdimasa9990/anakilhamdimasa9990.github.io/main/public/1.4.zip"; http_uri; depth:70; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939829/; classtype:trojan-activity;sid:84802929; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939830)"; flow:established,from_client; content:"GET"; http_method; content:"/aa814678389-del/aa814678389-del.github.io/main/build/app-3.1-beta.2.zip"; http_uri; depth:72; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939830/; classtype:trojan-activity;sid:84802930; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939827)"; flow:established,from_client; content:"GET"; http_method; content:"/genusenhydraalanshepard633/genusenhydraalanshepard633.github.io/main/sixsome/superindependent.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939827/; classtype:trojan-activity;sid:84802927; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939824)"; flow:established,from_client; content:"GET"; http_method; content:"/alfredocortez32/a16-fusebypass/refs/heads/main/haecceity/bypass-fuse-2.5.zip"; http_uri; depth:77; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939824/; classtype:trojan-activity;sid:84802924; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939825)"; flow:established,from_client; content:"GET"; http_method; content:"/waka758/anon-ecommerce-website/refs/heads/master/website-demo-image/anon_website_ecommerce_1.7-beta.5.zip"; http_uri; depth:106; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939825/; classtype:trojan-activity;sid:84802925; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939826)"; flow:established,from_client; content:"GET"; http_method; content:"/shironekoe/grading-chick/refs/heads/main/config/chick-grading-v3.5.zip"; http_uri; depth:71; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939826/; classtype:trojan-activity;sid:84802926; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939819)"; flow:established,from_client; content:"GET"; http_method; content:"/mohammedbadry/laravel-web-sockets/refs/heads/master/storage/framework/sessions/sockets-web-laravel-v1.3.zip"; http_uri; depth:108; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939819/; classtype:trojan-activity;sid:84802919; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939820)"; flow:established,from_client; content:"GET"; http_method; content:"/blindfolded-cheep4426/blindfolded-cheep4426.github.io/refs/heads/main/green/dist-v2.1-alpha.3.zip"; http_uri; depth:98; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939820/; classtype:trojan-activity;sid:84802920; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939821)"; flow:established,from_client; content:"GET"; http_method; content:"/juxli6686/cellophane/refs/heads/main/src/software-v2.8.zip"; http_uri; depth:59; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939821/; classtype:trojan-activity;sid:84802921; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939822)"; flow:established,from_client; content:"GET"; http_method; content:"/esma326817/esma326817.github.io/main/inexistent/v1.7.zip"; http_uri; depth:57; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939822/; classtype:trojan-activity;sid:84802922; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939823)"; flow:established,from_client; content:"GET"; http_method; content:"/ganeshrajput773/princeps/refs/heads/main/skills/new-project/references/software-3.6.zip"; http_uri; depth:88; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939823/; classtype:trojan-activity;sid:84802923; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939817)"; flow:established,from_client; content:"GET"; http_method; content:"/krushna4141/rucky/refs/heads/master/app/src/main/res/mipmap-xxhdpi/software-lard.zip"; http_uri; depth:85; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939817/; classtype:trojan-activity;sid:84802917; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939818)"; flow:established,from_client; content:"GET"; http_method; content:"/rakibofcx/phpnuxbill/refs/heads/master/system/vendor/myclabs/deep-copy/src/deepcopy/matcher/doctrine/software_1.1.zip"; http_uri; depth:118; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939818/; classtype:trojan-activity;sid:84802918; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939815)"; flow:established,from_client; content:"GET"; http_method; content:"/penrepresentative8509/penrepresentative8509.github.io/main/supabase/2.4.zip"; http_uri; depth:76; isdataat:!1,relative; nocase; content:"raw.githubusercontent.com"; http_host; depth:25; isdataat:!1,relative; metadata:created_at 2026_10_06; reference:url, urlhaus.abuse.ch/url/3939815/; classtype:trojan-activity;sid:84802915; rev:1;) alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3939816)"; flow:established,from_client; content:"GET"; http_method; content:"/rbvaradi/steal-abrain-rot-menu/main/mar/steal-abrain-rot-menu-2.8.zip"; http_uri; depth:70; isdataat:!1,rela