Versions (4)
Version DetailsCurrent
Rev: 5 • Feb 5, 2013, 12:00 PMET MOBILE_MALWARE Android/Fakelash.A!tr.spy Checkin
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android/Fakelash.A!tr.spy Checkin"; flow:to_server,established; http.uri; content:"/data.php?action="; nocase; content:"&online="; distance:0; content:"&m="; distance:0; content:"&ver="; distance:0; http.user_agent; content:"Dalvik/"; depth:7; reference:md5,7dec1c9174d0f688667f6c34c0fa66c2; reference:url,blog.fortiguard.com/android-malware-distributed-by-malicious-sms-in-france/; classtype:trojan-activity; sid:2016344; rev:5; metadata:affected_product Android, attack_target Mobile_Client, created_at 2013_02_05, deployment Perimeter, signature_severity Major, tag Android, updated_at 2020_10_14, mitre_tactic_id TA0010, mitre_tactic_name Exfiltration, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
Feb 5, 2013, 12:00 PM
Oct 14, 2020, 12:00 PM
Sep 21, 2024, 3:00 AM
May 30, 2025, 12:04 AM
rules/emerging-mobile_malware.rules