alert http any any -> any any (msg:"STEALER [PTsecurity] EncryptHub/Fickle"; flow:established, to_server; http.method; content:"POST"; http.uri; content:"/upload_file?filename="; startswith; content:"&buildType="; distance:0; http.header; content:"Content-Type|3a| multipart/form-data|3b| boundary=---------------------"; content:!"Referer"; http.request_body; content:".zip|22 0d 0a|Content-Type: application/octet-stream"; depth:200; content:"PK"; distance:0; content:"Fickle Stealer"; distance:0; fast_pattern; content:"screenshot"; distance:0; reference:url, tria.ge/250214-hmn8zawqfw/behavioral2; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10013159; rev:1;)