Versions (3)
Version DetailsCurrent
Rev: 1 • Oct 9, 2025, 2:49 PMSPYWARE [PTsecurity] Trojan.Spyware Sending data
alert http any any -> any any (msg:"SPYWARE [PTsecurity] Trojan.Spyware Sending data"; flow:established, to_server; http.method; content:"POST"; http.uri; content:"/api/data"; startswith; endswith; http.header; content:"Content-Type|3a| application/json"; content:"User-Agent|3a| Dalvik/"; content:"Connection|3a| Keep-Alive"; content:!"Referer"; http.request_body; content:"{|22|operator|22 3a 22|"; startswith; content:"|22|manufacturer|22 3a 22|"; distance:0; content:"|22|model|22 3a 22|"; distance:0; content:"|22|device_id|22 3a 22|"; distance:0; content:"|22|status|22 3a 22|"; distance:0; reference:url, tria.ge/250501-1z3k8sxshz/behavioral3; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10013934; rev:1;)
Oct 9, 2025, 2:49 PM
Feb 13, 2026, 3:29 PM
Oct 16, 2025, 10:34 AM
Mar 2, 2026, 1:34 PM
rules/ptopen-malware.rules