Rule History

alert http any any -> any any (msg: "DROPPER [PTsecurity] Trojan.Dropper Checkin"; flow: established, to_server; http.method; content: "POST"; http.uri; content: "/send"; startswith; endswith; http.header; content: "Content-Type|3a| application/json|3b| charset=utf-8"; content: !"Referer|3a|"; http.request_body; content: "{|22|message|22 3a 22|"; startswith; content: "|5c|u0411|5c|u0438|5c|u043B|5c|u0434"; distance: 0; fast_pattern; content: "|5c|u0410|5c|u043D|5c|u0442|5c|u0438|5c|u0432|5c|u0438|5c|u0440|5c|u0443|5c|u0441"; distance: 0; reference: url, www.joesandbox.com/analysis/1627611/0/html; reference: url, seqrite.com/blog/unmasking-grasscall-campaign-the-apt-behind-job-recruitment-cyber-scams/; reference: url, rules.ptsecurity.com; classtype: trojan-activity; sid: 10013060; rev: 2;)