ET MOBILE_MALWARE Android.Plankton/Tonclank Successful Installation Device Information POST

SID: 2013042Rev: 80 viewsHistory

Sourceet/open

CreatedJune 16, 2011

UpdatedMay 22, 2023

Classificationtrojan-activity

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android.Plankton/Tonclank Successful Installation Device Information POST"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/ProtocolGW/protocol/"; nocase; pcre:"/(?:(?:command(?:statu)?|bookmark|shortcut)s|h(?:omepage|istory)|eula(?:status)?|installation|activate|dumplog)/i"; reference:url,web.archive.org/web/20120113031916/http://www.csc.ncsu.edu/faculty/jiang/Plankton//; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2011-060910-5804-99&tabid=2; classtype:trojan-activity; sid:2013042; rev:8; metadata:created_at 2011_06_16, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_05_22;)

References

url	web.archive.org/web/20120113031916/http://www.csc.ncsu.edu/faculty/jiang/Plankton//
url	www.symantec.com/security_response/writeup.jsp?docid=2011-060910-5804-99&tabid=2

Metadata

created at2011_06_16

signature severityMajor

tagDescription_Generated_By_Proofpoint_Nexus

updated at2023_05_22

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!