alert http any any -> any any (msg:"STEALER [PTsecurity] SHub Exfiltration"; flow:established, to_server; http.method; content:"POST"; http.uri; content:"/api/upload"; startswith; endswith; fast_pattern; http.header; content:"Content-Type|3a| multipart/form-data|3b| boundary="; content:!"Accept"; content:!"Referer|3a|"; http.request_body; content:"Content-Disposition|3a| form-data|3b| name=|22|file|22 3b| filename=|22|"; depth:150; pcre:"/^[A-Z]{2}_[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}_20[0-9]{2}-[0-9]{2}-[0-9]{2}\x20[0-9]{2}_[0-9]{2}_[0-9]{2}_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.zip\x22\x0d\x0a/RP"; reference:url, www.virustotal.com/gui/file/929edcc602d8aabca416d3ea4e06f6a1c2ba47e8bec07386519c58c50f7861b0/detection; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10016299; rev:1;)