alert tcp any any -> any any (msg:"REMOTE [PTsecurity] BananaRAT/SmartRAT Checkin"; flow:established, to_server; stream_size:server, <, 4097; content:"LQWP"; startswith; fast_pattern; content:"|22|MachineDomain|22 3a|"; distance:0; content:"|22|ElevationType|22 3a|"; content:"|22|ScreenWidth|22 3a|"; content:"|22|TargetFps|22 3a|"; threshold:type limit, track by_src, seconds 180, count 1; reference:url, www.virustotal.com/gui/file/28f2d2817d454a0157ab268ecea624a14135662732204c73be42619b977a8692/detection; reference:url, zscaler.com/blogs/security-research/clickfix-campaign-generated-ai-delivers-smartrat; reference:url, www.trendmicro.com/en_us/research/26/e/banana-rat.html; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10016616; rev:2;)