alert http any any -> any any (msg:"STEALER [PTsecurity] StubWorm"; flow:established, to_server; http.method; content:"POST"; http.uri; content:"/gate.php"; endswith; http.header; content:!"Referer|3a|"; http.request_body; content:"action=stealer_logs&owner="; startswith; fast_pattern; reference:url, www.virustotal.com/gui/file/abe8936a4a96178c6467fe31973272e37bf60e35a743b2414b821c7ed896c2bf/detection; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10017150; rev:1;)