alert http any any -> any any (msg:"BANKER [PTsecurity] SuperCard X Checkin"; flow:established, to_server; http.method; content:"POST"; http.user_agent; content:"Ktor client"; bsize:11; http.header; content:"Authorization|3a| Bearer"; content:"Apikey|3a 20|"; nocase; content:"X-Client-Info|3a| supabase-kt/"; content:"Content-Type|3a| application/json"; content:!"Referer"; http.request_body; content:"{|22|p_client_type|22 3a 22|card|22|}"; startswith; endswith; fast_pattern; reference:url, tria.ge/250430-q2qpcaztaz/behavioral3; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10013904; rev:1;)