Versions (3)
Version DetailsCurrent
Rev: 1 • Oct 9, 2025, 2:49 PMADWARE [PTsecurity] Konfety Sending system info
alert http any any -> any any (msg:"ADWARE [PTsecurity] Konfety Sending system info"; flow:established, to_server; http.method; content:"GET"; http.uri; content:"network_operator="; fast_pattern; content:"&phone_type="; distance:0; content:"&sim_operator="; distance:0; content:"&network_vpn="; distance:0; content:"&sim_iso="; distance:0; content:"&networks="; distance:0; http.header; content:"User-Agent|3a| Mozilla/"; content:"Accept-Encoding|3a| gzip"; content:!"Referer|3a|"; threshold:type limit, track by_src, seconds 120, count 1; reference:url, tria.ge/250807-q2lemassex/behavioral1; reference:url, zimperium.com/blog/konfety-returns-classic-mobile-threat-with-new-evasion-techniques; reference:url, rules.ptsecurity.com; classtype:misc-activity; sid:10014406; rev:1;)
Oct 9, 2025, 2:49 PM
Feb 13, 2026, 3:29 PM
Oct 16, 2025, 10:34 AM
Mar 2, 2026, 1:34 PM
rules/ptopen-malware.rules