alert http any any -> any any (msg:"STEALER [PTsecurity] EncryptHub"; flow:established, to_server; http.method; content:"GET"; http.uri; content:"/main/tgreport/tgmes.ps1"; depth:24; http.user_agent; content:"WindowsPowerShell/"; reference:url, www.virustotal.com/gui/file/60959a8e3fa1bcd054f005b3ec3cd591675f9b8f8f7c11ba39d309184bd20f8c/; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10011739; rev:2;)