alert http any any -> any any (msg:"STEALER [PTsecurity] SHub Exfiltration"; flow:established, to_server; http.method; content:"POST"; http.uri; content:"/gate"; startswith; endswith; http.header; content:!"Referer|3a|"; nocase; content:"Content-Type|3a| multipart/form"; nocase; http.request_body; content:"filename=|22|shub"; depth:500; fast_pattern; content:"|0d 0a 0d 0a|PK|03 04|"; distance:0; content:"MACOSX"; distance:26; reference:url, tria.ge/260522-g2xcfsas5x/behavioral1; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10017452; rev:1;)