""ET MOBILE_MALWARE Android/Koler.C Checkin""

SID: 2019510

Revision: 5

Class Type: trojan-activity

Metadata: affected_product Android, attack_target Mobile_Client, created_at 2014_10_27, deployment Perimeter, tag Android, updated_at 2015_09_30, mitre_tactic_id TA0037, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel

Reference:

  • md5

  • 6ae7b0d04e2fd64a50703910d0eff9cc

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: to_server,established

Contents:

  • Value: ".php?v="

  • Value: "&brok="

  • Value: "&u="

  • Value: "&id="

  • Value: !"Referer|3a 20|"

Within:

PCRE: "/&id=\d{15}$/U"

Special Options:

  • http_uri

  • http_uri

  • http_uri

  • http_uri

  • http_header

source