I wrote about snort detecting this sometime ago. Sure Sourcefire could detect this too and now Cisco product =)!

http://blog.spiderlabs.com/2012/03/detecting-brazilian-trojan-bankers-with-snort-http_inspect.html

Regards.