alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ElectroRAT Command from Server (Screenshot)"; flow:established,from_server; content:"{|22|type|22 3a 22|Screenshot|22 2c 22|uid|22 3a|"; offset:2; depth:27; fast_pattern; reference:md5,3cd1639f28659348e22c2eb8482cd3d6; reference:url,www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets; classtype:trojan-activity; sid:2031479; rev:2; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2021_01_05, deployment Perimeter, deprecation_reason Age, malware_family ElectroRAT, confidence High, signature_severity Major, updated_at 2024_05_06, reviewed_at 2024_05_06;)