""ET MOBILE_MALWARE Android Chameleon Banking Trojan Activity (POST)""

SID: 2051764

Revision: 1

Class Type: trojan-activity

Metadata: attack_target Client_Endpoint, tls_state plaintext, created_at 2024_03_22, deployment Perimeter, confidence High, signature_severity Major, updated_at 2024_03_22

Reference:

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: 1024:

Flow: established,to_server

Contents:

  • Value: "POST"

  • Value: "/api/v1/bots/"

  • Value: "User-Agent|3a 20|Mozilla/5.0|0d 0a|"

  • Value: "&data="

  • Value: "|25 32 32|ip|25 32 32|"

  • Value: "|25 32 32|country|25 32 32|"

  • Value: "|25 32 32|location|25 32 32|"

  • Value: "|25 32 32|version|25 32 32|"

  • Value: "|25 32 32|imei|25 32 32|"

  • Value: "|25 32 32|number|25 32 32|"

  • Value: !"Referer|3a 20|"

Within:

PCRE:

Special Options:

  • fast_pattern

source