alert http any any -> any any (msg:"SPYWARE [PTsecurity] Trojan.Spyware Sending info"; flow:established, to_server; http.method; content:"POST"; http.uri; content:"/app-manage?"; startswith; content:"action="; distance:0; http.header; content:"Content-Type|3a| application/json|3b|"; nocase; content:"Accept-Encoding|3a| gzip"; nocase; content:!"Referer|3a|"; nocase; http.request_body; content:"{|22|android_id|22 3a 22|"; startswith; content:"|22|manufacturer|22 3a 22|"; distance:0; content:"|22|model|22 3a 22|"; distance:0; content:"|22|brand|22 3a 22|"; distance:0; content:"|22|device|22 3a 22|"; distance:0; content:"|22|subscriptions|22|"; distance:0; content:"|22|carrierName|22 3a 22|"; distance:0; fast_pattern; content:"|22|number|22 3a 22|"; distance:0; reference:url, tria.ge/250702-1w89ls1qx7/behavioral3; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10014301; rev:2;)