alert http any any -> any any (msg:"STEALER [PTsecurity] SHub Exfiltration"; flow:established, to_server; http.method; content:"POST"; http.header; content:"Content-Type|3a| application/json"; content:"api-key|3a 20|"; pcre:"/^[a-f0-9]{64}\x0d\x0a/RH"; content:!"Referer|3a|"; http.request_body; content:"{"; startswith; content:"|22|mnemonic|22 3a|"; within:13; fast_pattern; content:"|22|password|22 3a|"; distance:0; content:"|22|buildid|22 3a|"; distance:0; content:"|22|app|22 3a|"; distance:0; reference:url, medium.com/walmartglobaltech/shub-stealers-fake-crypto-apps-d5e2a65618b7; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10017277; rev:1;)