""ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Marcher.a Checkin""

SID: 2023553

Revision: 6

Class Type: trojan-activity

Metadata: affected_product Android, attack_target Mobile_Client, created_at 2014_04_18, deployment Perimeter, malware_family Android_Hqwar, tag Android, updated_at 2017_07_19, mitre_tactic_id TA0037, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel

Reference:

• md5

• f48cd0c0e5362142c0c15316fa2635dd

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: to_server,established

Contents:

• Value: "POST"

• Value: "/get.php|20|HTTP/1."

• Value: !"Referer|3a 20|"

• Value: "info"

Within:

PCRE: "/(?:^|&|\x22|{\x22)id(?:=|\x22\x3a\x22)(?:[a-f0-9]{32}|[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})(?:&|\x22|$)/P"

Special Options:

• http_method

• nocase

• http_header

• http_client_body

source