alert tcp any any -> any any (msg:"SPYWARE [PTsecurity] Grandoreiro"; flow:established, to_server; content:"%"; http_uri; content:","; http_uri; distance:0; content:"@"; http_uri; distance:0; content:")"; http_uri; distance:0; content:"$"; http_uri; distance:0; content:"*"; http_uri; distance:0; content:"Accept: */*"; http_header; content:"Accept-Encoding|3A| gzip"; http_header; content:"User-Agent|3A| Mozilla/4.0 (compatible|3B| Clever Internet Suite)"; http_header; content:!"Referer"; http_header; reference:url, https://app.any.run/tasks/cf1c73d6-a0e7-426f-b77a-b84e3302c3ae; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10011166; rev:2;)