""ET MOBILE_MALWARE PJobRat System Exfil to CnC""

SID: 2033319

Revision: 1

Class Type: trojan-activity

Metadata: affected_product Android, created_at 2021_07_13, updated_at 2021_07_13

Reference:

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: to_server,established

Contents:

  • Value: "POST"

  • Value: "|7b 22|network|22 3a 22|"

  • Value: "|22 2c 22|type|22 3a 22 5b|"

  • Value: "|22 2c 22|info|22 3a 22|"

  • Value: "|22 2c 22|ipaddr|22 3a 22|"

  • Value: "|22 2c 22|bandwidth|22 3a 22|"

  • Value: "|22 2c 22|downspeed|22 3a 22|"

  • Value: "|22 2c 22|upspeed|22 3a 22|"

  • Value: "|22 2c 22|rip|22 3a 22|"

  • Value: "|22 2c 22|manufacture|22 3a 22|"

  • Value: "|22 2c 22|imei|22 3a 22|"

  • Value: "|22 2c 22|pnumber|22 3a 22|"

  • Value: "|22 2c 22|location|22 3a 22 5b 7b 5c 22|latitude|5c 22 3a 5c 22|"

  • Value: "|22 2c 22|appname|22 3a 22|"

Within:

PCRE:

Special Options:

  • http_method

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • http_client_body

  • fast_pattern

  • http_client_body

  • http_client_body

source