alert http any any -> any any (msg:"BANKER [PTsecurity] Hydra"; flow:established, to_server; http.method; content:"POST"; http.uri; content:"/api/v1/device/update"; http.header; content:"charset: utf-8"; nocase; http.request_body; content:"{|22|bot_phones|22|:"; depth:14; fast_pattern; reference:url, tria.ge/240808-w3nt2a1brd/behavioral1; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10012079; rev:1;)