alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE CopperStealer - Browser Stealer Exfil via Telegram"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/bot"; content:"/sendDocument"; endswith; http.content_type; content:"multipart|2f|form|2d|data|3b 20|boundary|3d 2d 2d 2d 2d|WebKitFormBoundaryovEAlxca0DiIz7tl"; bsize:68; fast_pattern; http.request_body; content:"Content|2d|Disposition|3a 20|form|2d|data|3b 20|name|3d 22|document|22 3b 20|filename|3d 22|"; content:".zip|22 0d 0a|Content-Type: application/x-zip-compressed|0d 0a 0d 0a 37 7a bc af 27 1c|"; distance:36; within:85; reference:md5,2420ce50752a9c25203cecbe194606c5; reference:md5,04bc575585d4663f227cef14a65bea26; reference:url,www.trendmicro.com/en_us/research/22/f/websites-hosting-fake-cracks-spread-updated-copperstealer.html; classtype:trojan-activity; sid:2037027; rev:1; metadata:created_at 2022_06_17, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_06_17;)