Rule History

alert http any any -> any any (msg: "STEALER [PTsecurity] EncryptHub/Fickle"; flow: established, to_server; http.method; content: "POST"; http.uri; content: "/upload_file?filename="; startswith; content: "&buildType="; distance: 0; http.header; content: "Content-Type|3a| multipart/form-data|3b| boundary=---------------------"; content: !"Referer"; http.request_body; content: ".zip|22 0d 0a|Content-Type: application/octet-stream"; depth: 200; content: "PK"; distance: 0; content: "Fickle Stealer"; distance: 0; fast_pattern; content: "screenshot"; distance: 0; reference: url, tria.ge/250214-hmn8zawqfw/behavioral2; reference: url, rules.ptsecurity.com; classtype: trojan-activity; sid: 10013159; rev: 1;)