alert http any any -> any any (msg:"BANKER [PTsecurity] Zanubis"; flow:established, to_server; http.method; content:"POST"; http.uri; content:"/socket.io/"; http.header; content:"Content-Type: text/plain"; content:"Accept-Encoding: gzip"; content:"User-Agent: okhttp/"; content:!"Referer"; http.request_body; content:"[|22|inicio|22|,|22|"; depth:14; fast_pattern; content:"=:"; distance:43; within:3; content:"==:"; distance:22; within:4; reference:url, https://www.virustotal.com/gui/file/f6efdc5aa776a013ec6802d33a90676d83f5a6e07324a2775cf1994eb252ff8d/detection; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10012111; rev:2;)