alert tcp any any -> any any (msg:"LOADER [PTsecurity] AllaKore"; flow:established, to_server; dsize:100<>200; stream_size:server, <, 3; stream_size:client, <, 201; base64_decode:bytes 100; base64_data; content:"pyCodeV16"; depth:9; content:"*NEW"; distance:0; content:"|20 7c 20|"; distance:0; content:"|20 7c 20|"; distance:0; reference:url, https://tria.ge/240918-mvh45swfkf/behavioral2; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10012001; rev:2;)