Back to Rule

Rule History

SID: 2035489 • Source: et/open

Versions (5)

Rev: 2
Sep 5, 2025, 9:34 PM
Current
Rev: 2
Sep 21, 2024, 3:00 AM
Archived
Rev: 2
Sep 10, 2024, 1:01 PM
Archived
Rev: 2
May 31, 2024, 9:00 PM
Archived
Rev: 2
Mar 17, 2022, 12:00 PM
Archived

Version Details

Rev: 2 • Mar 17, 2022, 12:00 PM

ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Realrat.c (TLS SNI) 3

alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Trojan-Spy.AndroidOS.Realrat.c (TLS SNI) 3"; flow:established,to_server; tls_sni; content:"alfa-toxic.xyz"; isdataat:!1,relative; nocase; reference:md5,2ea18b97e95171afabd9cfafa4813812; classtype:command-and-control; sid:2035489; rev:2; metadata:created_at 2022_03_17, confidence High, signature_severity Major, updated_at 2022_03_17;)

Mar 17, 2022, 12:00 PM

Mar 17, 2022, 12:00 PM

Sep 21, 2024, 3:00 AM

Sep 21, 2024, 3:00 AM

Sep 5, 2025, 9:34 PM

rules/emerging-mobile_malware.rules