alert http any any -> any any (msg:"SPYWARE [PTsecurity] SpyNote"; flow:established, to_server; http.method; content:"POST"; http.uri; content:"/app/saveDevice"; startswith; endswith; http.header; content:"Content-Type|3a| application/x-www-form-urlencoded"; content:"User-Agent|3a| okhttp/"; content:!"Referer"; http.request_body; content:"product="; startswith; content:"&android_version="; distance:0; content:"&deviceName="; distance:0; content:"&model="; distance:0; content:"&aid="; distance:0; reference:url, tria.ge/250417-sq294swxhz/behavioral6; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10013745; rev:1;)