alert http any any -> any any (msg:"STEALER [PTsecurity] Astaroth Checkin"; flow:established, to_server; http.method; content:"POST"; http.uri; content:".php"; endswith; http.header; content:"Content-Type|3a| application/x-www-form-urlencoded"; content:"Accept|3a| */*"; content:!"Referer|3a|"; http.request_body; content:"nome_pc="; startswith; fast_pattern; content:"&sistema_operacional="; distance:0; content:"&usuario="; distance:0; content:"&ip_externo="; distance:0; content:"&bancos_detectados="; distance:0; reference:url, www.virustotal.com/gui/file/acae76975b3a31134f3e728b20e242a519286da97a6b7136569e1b38723e7198/detection; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10015586; rev:1;)