Rule History

alert http any any -> any any (msg: "BANKER [PTsecurity] Zanubis"; flow: established, to_server; http.method; content: "POST"; http.uri; content: "/socket.io/"; http.header; content: "Content-Type: text/plain"; content: "Accept-Encoding: gzip"; content: "User-Agent: okhttp/"; content: !"Referer"; http.request_body; content: "[|22|inicio|22|,|22|"; depth: 14; fast_pattern; content: "=:"; distance: 43; within: 3; content: "==:"; distance: 22; within: 4; reference: url, https://www.virustotal.com/gui/file/f6efdc5aa776a013ec6802d33a90676d83f5a6e07324a2775cf1994eb252ff8d/detection; reference: url, rules.ptsecurity.com; classtype: trojan-activity; sid: 10012111; rev: 2;)