alert http any any -> any any (msg:"BANKER [PTsecurity] Hydra"; flow:established, to_server; http.method; content:"POST"; http.uri; content:"/api/v1/device"; http.header; content:"charset: utf-8"; nocase; http.request_body; content:"{|22|country|22|"; depth:10; content:"|22|admin_rights_enabled|22|:"; distance:0; fast_pattern; content:"|22|os_version|22|:"; distance:0; content:"|22|tag|22|:"; distance:0; content:"|22|push_token|22|:"; distance:0; reference:url, tria.ge/240808-w3nt2a1brd/behavioral1; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10012090; rev:1;)