alert http any any -> any any (msg:"LOADER [PTsecurity] SafeRAT"; flow:established, to_client; http.stat_code; content:"200"; http.header; content:"Content-Type"; content:"Accept-Ranges: bytes"; content:"Content-Disposition"; http.response_body; content:"UVWATAUAVAWH"; offset:5; depth:12; flowbits:isset, SafeRAT_loader; flowbits:unset, SafeRAT_loader; reference:url, https://www.virustotal.com/gui/file/859e09a10260c646d2864c1f718c551ea566e8612f47979e6de4076c480c8cbc/detection; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10011880; rev:1;)