alert http any any -> any any (msg:"BANKER [PTsecurity] Possible Trojan.Banker"; flow:established, to_server; http.method; content:"POST"; http.uri; content:".php"; http.header; content:!"Referer"; http.request_body; content:"dados="; depth:6; reference:url, https://www.virustotal.com/gui/file/70d3b577620279fd2a2e6cb39e601e5c3342b375f0e53d8771ded26442bafeb9/detection; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10011251; rev:1;)