Rule History

alert dns $HOME_NET any -> any any (msg:"ET MOBILE_MALWARE Android/Spy.Agent.ANA (androidssystem .com in DNS Lookup)"; dns.query; content:"androidssystem.com"; endswith; reference:md5,81281261132fba4c8ec70322250965b7; reference:url,blog.trendmicro.com/trendlabs-security-intelligence/mobile-cyberespionage-campaign-bouncing-golf-affects-middle-east/; classtype:trojan-activity; sid:2027491; rev:4; metadata:affected_product Android, attack_target Mobile_Client, created_at 2019_06_19, deployment Perimeter, malware_family Android_SpyAgent, confidence Medium, signature_severity Critical, tag Android, updated_at 2020_09_17;)