alert http any any -> any any (msg:"STEALER [PTsecurity] Majanito/WeedHack Exfiltration"; flow:established, to_server; http.method; content:"POST"; http.header; content:"Content-Type|3a| application/json"; content:!"Referer|3a|"; http.request_body; content:"{|22|userId|22 3a|"; startswith; content:"|22|executionEnvironment|22 3a|"; distance:0; fast_pattern; content:"|22|executionEnvironmentType|22 3a|"; distance:0; content:"|22|osVersion|22 3a|"; distance:0; content:"|22|screenshot|22 3a|"; distance:0; reference:url, app.any.run/tasks/347fd887-e8ae-4cad-a823-8448d36ac5d8; reference:url, habr.com/ru/companies/F6/news/1025464/; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10017228; rev:1;)