alert http any any -> any any (msg:"BANKER [PTsecurity] Trojan.Banker"; flow:established, to_server; http.method; content:"POST"; http.uri; content:".php"; http.header; content:"Content-Type: application/x-www-form-urlencoded"; content:"Accept: text/html, */*"; content:!"Referer"; http.request_body; content:"titulo="; depth:7; nocase; content:"&texto="; distance:0; within:100; nocase; content:"Mac"; distance:0; nocase; content:"Resolucao"; distance:0; nocase; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10011254; rev:1;)