alert tcp any any -> any any (msg:"LOADER [PTsecurity] PrivateLoader"; flow:established, to_client; stream_size:client, =, 45; stream_size:server, =, 13; content:"|10 00 00 00|"; depth:4; flowbits:isset, priloader_2st_client_pkt; flowbits:unset, priloader_2st_client_pkt; reference:url, https://tria.ge/240924-seflzatcpg/behavioral2; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10012030; rev:1;)