Rule History

alert dns $HOME_NET any -> any any (msg:"ET MOBILE_MALWARE Trojan.AndroidOS.TimpDoor (purple .itraffic .click in DNS Lookup)"; dns.query; content:"purple.itraffic.click"; endswith; reference:md5,f626bbe0720323635f75ba08b1e7e8e4; reference:md5,5faad53df0fa1f4d5c199b49c77025eb; classtype:trojan-activity; sid:2027804; rev:4; metadata:affected_product Android, attack_target Mobile_Client, created_at 2019_08_06, deployment Perimeter, malware_family Android_TimpDoor, confidence High, signature_severity Critical, tag Android, updated_at 2020_09_17;)