Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android/FluBot Trojan Sending Information (POST)"; flow:established,to_server; http.request_line; content:"POST /p.php HTTP/1.1"; fast_pattern; http.user_agent; content:"Dalvik/"; startswith; http.header_names; content:!"Referer"; http.host; pcre:"/^[a-z]{15}\.(?:ru|su|cn)$/"; reference:md5,a65d00f3688dc02e2544e02eb57a06c1; reference:url,www.f5.com/labs/articles/threat-intelligence/flubots-authors-employ-creative-and-sophisticated-techniques-to-achieve-their-goals-in-version-50-and-beyond; classtype:trojan-activity; sid:2034913; rev:1; metadata:attack_target Mobile_Client, created_at 2022_01_13, deployment Perimeter, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_01_13;)