alert tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"ET MALWARE PredatorPain Keylogger FTP Activity"; flow:established,to_server; dsize:21; content:"USER|20|panzerhund2015|0d 0a|"; fast_pattern; reference:url,malwareconfig.com/stats/PredatorPain; reference:md5,e5ddca929924e4f34cb18692f09ac424; classtype:trojan-activity; sid:2021745; rev:2; metadata:created_at 2015_09_04, signature_severity Major, updated_at 2022_03_17;)