ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Wroba Lure (Package Delivery)

SID: 2036215Rev: 20 viewsHistory

Sourceet/open

CreatedApril 14, 2022

UpdatedApril 14, 2022

Classificationtrojan-activity

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Wroba Lure (Package Delivery)"; flow:established,to_client; content:"|82|"; startswith; content:"jsonrpc"; distance:5; within:8; content:"Your parcel has been sent out.Please check and accept it. http"; fast_pattern; reference:url,team-cymru.com/blog/2022/04/07/moqhao-part-2-continued-european-expansion; classtype:trojan-activity; sid:2036215; rev:2; metadata:affected_product Android, attack_target Mobile_Client, created_at 2022_04_14, deployment Perimeter, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_04_14;)

References

url	team-cymru.com/blog/2022/04/07/moqhao-part-2-continued-european-expansion

Metadata

affected productAndroid

attack targetMobile_Client

created at2022_04_14

deploymentPerimeter

confidenceHigh

signature severityMajor

tagDescription_Generated_By_Proofpoint_Nexus

updated at2022_04_14

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!