alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MOBILE_MALWARE Android.Trojan.AndroRAT.CE Checkin"; flow:to_server,established; content:"info=user"; depth:20; content:"simCountryCode="; distance:0; fast_pattern; content:"posnetwork="; distance:0; content:"recMic="; distance:0; content:"callMoniter="; distance:0; content:"callWhere="; distance:0; reference:md5,5cffec9d80acd836e945e410061363ca; classtype:command-and-control; sid:2035483; rev:2; metadata:created_at 2022_03_17, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_03_17;)