alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Win32/Ficker Stealer Activity M2"; flow:established,to_client; dsize:1051; content:"|04 19 00 00 00 1a 00 00 00 17 25 75 73 65 72 70 72 6f 66 69 6c 65 25 5c 44 6f 63 75 6d 65 6e 74 73 00 00 00 08 55 54 43 2d 2d|"; depth:42; reference:url,twitter.com/malware_traffic/status/1321182175916679168; reference:md5,25cddcec88ee81aab4db84bbd19a64d6; reference:url,app.any.run/tasks/228c144e-90a0-4e8f-87d8-102bc04b0335/; classtype:trojan-activity; sid:2031131; rev:1; metadata:attack_target Client_Endpoint, created_at 2020_10_28, deployment Perimeter, malware_family Win32_Ficker, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_10_28;)