alert tcp any any -> any any (msg:"🐾 - ☣ Download request 🌐 Zloader ♞"; flow:to_server, stateless; content:"GET"; content:"/wp-keys.php"; fast_pattern; reference:url,https://bazaar.abuse.ch/sample/13509b3f6aeacb569938cc1baa474beac1c0e6d1ce222ca681d9d463889babac/; reference:url,https://malpedia.caad.fkie.fraunhofer.de/details/win.zloader; metadata:created_at 2020_08_24, updated_at 2020_08_24; sid:3321240; rev:1; classtype:trojan-activity;)