alert http any any -> any any (msg:"STEALER [PTsecurity] XavierEra"; flow:established, to_server; http.method; content:"POST"; http.uri; content:"/pip/x/requirements.php"; endswith; http.header; content:"User-Agent: python-requests/"; content:"Accept-Encoding: gzip, deflate, br"; content:"Content-Type: multipart/form-data|3b| boundary="; content:!"Referer"; http.request_body; content:"|50 4b|"; depth:150; content:"Cookies"; distance:0; content:"_Default_PASS"; distance:0; fast_pattern; reference:url, https://app.any.run/tasks/d914b17f-c258-4522-9370-bd972106fa04; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10012300; rev:1;)