alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android BatteryBotPro Checkin"; flow:to_server,established; http.method; content:"POST"; nocase; http.user_agent; content:"Mozilla/5.0 (Windows NT 5.2|29 20|"; startswith; http.request_body; content:"appid="; depth:6; content:"&model="; content:"&imei="; fast_pattern; content:"&connect="; content:"&dpi="; content:"&width="; content:"&cpu="; content:"&phoneno="; reference:md5,6f39ac1c8c34ab9ba51bf26eba4cc6fb; reference:url,research.zscaler.com/2015/07/fake-batterybotpro-clickfraud-adfruad.html; classtype:trojan-activity; sid:2021386; rev:4; metadata:affected_product Android, attack_target Mobile_Client, created_at 2015_07_07, deployment Perimeter, signature_severity Major, tag Android, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_10_01, mitre_tactic_id TA0010, mitre_tactic_name Exfiltration, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)