Makloader

alert tcp any any -> any $HTTP_PORTS (msg:"Makloader"; flow:to_server,established; content:"GET"; http_method; content:"|2e|php|3f|i="; content:"cache="; content:"MSIE 7|2e|0"; http_header; classtype:trojan-activity; sid:20166261; rev:1; metadata:created_at 2018_10_02;)

rule Makloader_memory
{
    meta:
        author = " James_inthe_box"
        date = "2018/10"
        maltype = "Loader"

    strings:
        $string1 = "MAKtEMPmUTEX"
        $string2 = "URLOpenBlockingStreamA"
        $string3 = "Qkkbal"

    condition:
        all of ($string*)
}