alert http any any -> any any (msg:"ADWARE [PTsecurity] Konfety Sending system info"; flow:established, to_server; http.method; content:"GET"; http.uri; content:"network_operator="; fast_pattern; content:"&phone_type="; distance:0; content:"&sim_operator="; distance:0; content:"&network_vpn="; distance:0; content:"&sim_iso="; distance:0; content:"&networks="; distance:0; http.header; content:"User-Agent|3a| Mozilla/"; content:"Accept-Encoding|3a| gzip"; content:!"Referer|3a|"; threshold:type limit, track by_src, seconds 120, count 1; reference:url, tria.ge/250807-q2lemassex/behavioral1; reference:url, zimperium.com/blog/konfety-returns-classic-mobile-threat-with-new-evasion-techniques; reference:url, rules.ptsecurity.com; classtype:misc-activity; sid:10014406; rev:1;)