""ET MOBILE_MALWARE Android/Spy.Agent.BEH Variant Activity (POST)""

SID: 2033946

Revision: 2

Class Type: trojan-activity

Metadata: created_at 2021_09_14, updated_at 2021_09_14

Reference:

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: any

Flow: established,to_server

Contents:

  • Value: "POST"

  • Value: "/socket.io/?release="

  • Value: "&model="

  • Value: "&EIO="

  • Value: "&id="

  • Value: "&transport="

  • Value: "&manf="

  • Value: "&sid="

  • Value: "|28|Linux|3b 20|U|3b 20|Android"

  • Value: "contactsList"

  • Value: "phoneNo"

  • Value: !"Referer"

Within:

PCRE: "/Host\x3a\x20\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}/"

Special Options:

  • fast_pattern

source