""ET TROJAN Android/MMRAT CnC Checkin M2""

SID: 2048086

Revision: 1

Class Type: trojan-activity

Metadata: affected_product Android, attack_target Client_Endpoint, created_at 2023_09_13, deployment Perimeter, malware_family MMRAT, performance_impact Low, confidence High, signature_severity Major, updated_at 2023_09_13, reviewed_at 2023_09_13

Reference:

  • md5

  • 5b90ee49ed678379f1a8be9683b3fc99

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: any

Flow: established,to_server

Contents:

  • Value: "|10|"

Offset: 5

  • Value: "|01 01 34 90 01 01|"

Within:

PCRE: "/^[a-f0-9]{16}/R"

Special Options:

  • fast_pattern

source