alert tcp any any -> any any (msg:"REMOTE [PTsecurity] Remcos Checkin"; flow:established, to_server; content:"|66 9f 28 56 e7 cf 92 dd 76 54 c5|"; startswith; fast_pattern; content:"|1c 65|"; distance:2; within:2; reference:url, www.genians.co.kr/blog/threat_intelligence/toybox-story; reference:url, www.virustotal.com/gui/file/0701b0f2b6171ea45c25df6c04d3d6d50f29b8c1a98f12d7618bb2a6989d7f4a/detection; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10014060; rev:1;)