alert http any any -> any any (msg:"DROPPER [PTsecurity] Trojan.Dropper Checkin"; flow:established, to_server; http.method; content:"POST"; http.uri; content:"/send"; startswith; endswith; http.header; content:"Content-Type|3a| application/json|3b| charset=utf-8"; content:!"Referer|3a|"; http.request_body; content:"{|22|message|22 3a 22|"; startswith; content:"|5c|u0411|5c|u0438|5c|u043B|5c|u0434"; distance:0; fast_pattern; content:"|5c|u0410|5c|u043D|5c|u0442|5c|u0438|5c|u0432|5c|u0438|5c|u0440|5c|u0443|5c|u0441"; distance:0; reference:url, www.joesandbox.com/analysis/1627611/0/html; reference:url, seqrite.com/blog/unmasking-grasscall-campaign-the-apt-behind-job-recruitment-cyber-scams/; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10013060; rev:2;)