alert tcp any any -> any any (msg:"BACKDOOR [PTsecurity] AdAptertrAin Response"; flow:established, to_client; content:"###%k###"; depth:16; fast_pattern; pcre:"/\x20([0-9]{1,3}\.){3}[0-9]{1,3}/R"; content:"###%k###"; distance:0; reference:url, https://tria.ge/240116-da7gkabfck/behavioral3; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10010801; rev:1;)