alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android BatteryBotPro Checkin 2"; flow:to_server,established; http.method; content:"POST"; nocase; http.request_body; content:"uuid="; content:"language="; content:"appkey"; content:"model="; content:"operatorsname="; fast_pattern; content:"networkname="; content:"networktype="; reference:md5,6f39ac1c8c34ab9ba51bf26eba4cc6fb; reference:url,research.zscaler.com/2015/07/fake-batterybotpro-clickfraud-adfruad.html; classtype:trojan-activity; sid:2021387; rev:5; metadata:affected_product Android, attack_target Mobile_Client, created_at 2015_07_07, deployment Perimeter, signature_severity Major, tag Android, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_10_01, mitre_tactic_id TA0010, mitre_tactic_name Exfiltration, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)