alert http any any -> any any (msg:"STEALER [PTsecurity] MetaStealer"; flow:established, to_server; content:"GET"; http_method; content:"/avast_update"; http_uri; depth:13; fast_pattern; content:"Connection|3A| close"; http_header; content:"cpp-httplib/"; http_user_agent; content:!"avast"; http_host; content:!"Referer"; http_header; content:!"Pragma"; http_header; reference:md5, 37880a9cbdc396b07436de5a2e7bb25b; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10010717; rev:4;)