alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Trojan-Ransom.AndroidOS.CryCrypt.c Checkin"; flow:established,to_server; http.uri; content:"/socket.io/?EIO=3&transport=polling"; http.header; content:"finger|3a 20|eyJhcGlWZXJzaW9uIjo"; fast_pattern; http.user_agent; content:"okhttp/"; http.header_names; content:!"Referer"; reference:md5,fdf3e983bc097042d6d6cdb4fb62639e; reference:url,www.lookout.com/blog/iranian-spyware-bouldspy; classtype:command-and-control; sid:2045287; rev:1; metadata:affected_product Any, attack_target Mobile_Client, created_at 2023_05_02, deployment Perimeter, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_05_02;)