alert http any any -> any any (msg:"STEALER [PTsecurity] Stealc Sending Data"; flow:established, to_server; http.method; content:"POST"; http.uri; content:"/api.php"; startswith; endswith; http.header; content:!"Accept"; content:!"Referer|3a|"; http.request_body; content:"|37 2b 26 7f 00|"; startswith; fast_pattern; content:"qszwtzu"; reference:url, www.virustotal.com/gui/file/6a0d2f0df86dd6a9f033febfe0ca7b6f3edf1374eacd9f21bd44d825d906dd6f/detection; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10017510; rev:1;)