alert http any any -> any any (msg:"PAYLOAD [PTsecurity] Majanito/WeedHack"; flow:established, to_client; http.header; content:"Content-Type|3a| application/java-archive"; http.response_body; content:"PK|03 04|"; startswith; content:"dev/majanito/"; within:64; fast_pattern; content:"/majanito/"; distance:0; threshold:type limit, track by_src, seconds 180, count 1; reference:url, app.any.run/tasks/347fd887-e8ae-4cad-a823-8448d36ac5d8; reference:url, habr.com/ru/companies/F6/news/1025464/; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10017226; rev:1;)