alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android GolfSpy (services4me .net in TLS SNI)"; flow:established,to_server; tls_sni; content:"services4me.net"; isdataat:!1,relative; nocase; reference:md5,a762768c582064880a29934c81e24ba2; classtype:command-and-control; sid:2032270; rev:2; metadata:affected_product Android, attack_target Mobile_Client, created_at 2021_03_22, deployment Perimeter, confidence High, signature_severity Critical, tag Android, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_03_22;)