Rule History

alert dns $HOME_NET any -> any any (msg:"ET MOBILE_MALWARE DNS Query for gongfu-android.com DroidKungFu CnC Server"; dns.query; content:"gongfu-android.com"; depth:18; endswith; reference:url,extraexploit.blogspot.com/2011/06/droidkungfu-just-some-piece-of-code.html; reference:url,www.redmondpie.com/droidkungfu-new-hard-to-detect-android-malware-threat-on-the-loose-steals-user-data-and-more/; reference:url,www.fortiguard.com/encyclopedia/virus/android_droidkungfu.a!tr.html; classtype:command-and-control; sid:2013023; rev:6; metadata:affected_product Android, attack_target Client_Endpoint, created_at 2011_06_13, deployment Perimeter, confidence Medium, signature_severity Critical, tag Android, updated_at 2020_09_17;)