alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE VaultCrypt Uploading Files"; flow:established,to_server; urilen:6; http.method; content:"POST"; http.uri; content:"/v.php"; fast_pattern; http.content_type; bsize:18; content:"application/upload"; http.header; content:"|0d 0a|UA-CPU|3a 20|"; content:"boundary=---------------------------0123456789012"; http.request_body; content:"name=|22|pf|22 3b|"; reference:url,www.bleepingcomputer.com/forums/t/570390/vaultcrypt-uses-batch-files-and-open-source-gnupg-to-hold-your-files-hostage; classtype:trojan-activity; sid:2020707; rev:5; metadata:created_at 2015_03_18, signature_severity Major, updated_at 2024_03_03;)