alert http any any -> any any (msg:"BANKER [PTsecurity] RedHook Checkin"; flow:established, to_server; http.method; content:"POST"; http.header; content:"clientId|3a 20|"; pcre:"/^[0-9a-f]{32}\x0d\x0a/RH"; content:"Accept|3a| */*"; content:"Authorization|3a| Bearer"; content:"Content-Type|3a| application/json"; content:"User-Agent|3a| okhttp/"; content:!"Referer|3a|"; http.request_body; content:"{|22|deviceNumber|22 3a 22|"; startswith; content:"|22|lockType|22 3a|"; distance:0; fast_pattern; content:"|22|brand|22 3a 22|"; distance:0; content:"|22|angle|22 3a 22|"; distance:0; content:"|22|sensor|22 3a 22|"; distance:0; content:"|22|}"; endswith; reference:url, tria.ge/250811-yb6lwatsds/behavioral1; reference:url, cyble.com/blog/redhook-new-android-banking-targeting-in-vietnam/; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10014434; rev:1;)