Rule History

alert http any any -> any any (msg: "BANKER [PTsecurity] Possible Trojan.Banker"; flow: established, to_server; http.method; content: "POST"; http.uri; content: ".php"; http.header; content: !"Referer"; http.request_body; content: "dados="; depth: 6; reference: url, https://www.virustotal.com/gui/file/70d3b577620279fd2a2e6cb39e601e5c3342b375f0e53d8771ded26442bafeb9/detection; reference: url, rules.ptsecurity.com; classtype: trojan-activity; sid: 10011251; rev: 1;)