alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Kimsuky APT Related Win32/RftRAT Activity"; flow:established,to_server; dsize:580; content:"|ef a7 3d 96|"; startswith; fast_pattern; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; endswith; reference:md5,093608a2d6eb098eb7ea917cc22e9998; reference:md5,a2b3fbd4da7a46e1b77da04b858ed7af; reference:md5,c55da826e50e2615903607e61968778f; classtype:trojan-activity; sid:2049873; rev:1; metadata:attack_target Client_Endpoint, created_at 2024_01_02, deployment Perimeter, malware_family Win32_RftRAT, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_01_02; target:src_ip;)