alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Trojan.AndroidOS.TimpDoor Module Download Request"; flow:to_server,established; http.uri; content:"/?uuid="; content:"&ptype="; content:"&cacheFrom="; fast_pattern; http.user_agent; content:"|3b 20|Android|20|"; http.header_names; content:!"Referer|0d 0a|"; reference:md5,5faad53df0fa1f4d5c199b49c77025eb; classtype:trojan-activity; sid:2027803; rev:3; metadata:affected_product Android, attack_target Mobile_Client, created_at 2019_08_06, deployment Perimeter, malware_family Android_TimpDoor, confidence High, signature_severity Critical, tag Android, updated_at 2020_08_31;)