alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE [PTsecurity] Trojan.Ranapama.JH pkt checker #1"; flow:established, to_client; dsize:3; stream_size:server, =,4; stream_size:client, >,51; stream_size:client, <,58; pcre:"/^(?:[\x1f-\x80])+$/"; flowbits:noalert; flowbits:isset, FB710046_0; flowbits:unset, FB710046_0; flowbits:set, FB710046_1; classtype:trojan-activity; metadata:created_at 2018_10_11; reference:url, github.com/ptresearch/AttackDetection; sid:11003922; rev:1;)