alert smtp any any -> any any (msg:"KEYLOGGER [PTsecurity] SnakeKeylogger Exfiltration via SMTP"; flow:established, to_server; content:"Subject|3a 20|"; depth:300; content:"/ Passwords /"; within:40; fast_pattern; content:"Content-Type|3a| text/plain|3b| charset=us-ascii"; distance:0; content:"Content-Type|3a| text/plain|3b| name=UserData.txt"; distance:0; content:"Content-Transfer-Encoding|3a| base64"; distance:0; reference:url, www.virustotal.com/gui/file/7d698e08027896134a3aa11a32d7938d1aba10fb734b4973e24406f32f4cab39/detection; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10014017; rev:1;)