alert tcp any any -> any any (msg:"REMOTE [PTsecurity] KongRAT Sending System Info"; flow:established, to_server, only_stream; stream_size:server, <, 4097; stream_size:client, <, 4097; content:"MPK1"; offset:4; depth:4; fast_pattern; content:"|00|AV|05|"; distance:0; content:"|00|DESC|05|"; distance:0; content:"|00|GROUP|05|"; distance:0; content:"|00|PROCESS|05|"; distance:0; reference:url, www.virustotal.com/gui/file/ed68397183e72e7113c8ac4aceddf2051abf55d7c62b6fa69f62cbda11324ab8/detection; reference:url, www.esentire.com/blog/multi-stage-seo-poisoning-campaign-targets-chinese-speaking-developers-with-kong-rat; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10017434; rev:1;)