alert tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET MALWARE LDPinch SMTP Password Report"; flow:established,to_server; content:"Subject|3a| Passes from"; nocase; fast_pattern; content:"application/octet-stream|3b|"; content:".bin"; within:100; classtype:trojan-activity; sid:2008034; rev:7; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2020_08_19;)