alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE [PTsecurity] Trojan.Ranapama.JH"; flow:established, to_server; dsize:2; stream_size:server, =,4; stream_size:client, >,53; stream_size:client, <,62; pcre:"/^(?:[\x1f-\x80])+$/"; flowbits:isset, FB710046_1; flowbits:unset, FB710046_1; classtype:trojan-activity; metadata:created_at 2018_10_11; reference:url, github.com/ptresearch/AttackDetection; sid:11003923; rev:1;)