alert http $HOME_NET any -> $EXTERNAL_NET any (
msg:"ET MOBILE_MALWARE Android.Plankton/Tonclank Successful Installation Device Information POST";
flow:established,to_server;
http.method;
content:"POST";
http.uri;
content:"/ProtocolGW/protocol/"; nocase;
pcre:"/(?:(?:command(?:statu)?|bookmark|shortcut)s|h(?:omepage|istory)|eula(?:status)?|installation|activate|dumplog)/i";
reference:url,web.archive.org/web/20120113031916/http://www.csc.ncsu.edu/faculty/jiang/Plankton//;
reference:url,www.symantec.com/security_response/writeup.jsp?docid=2011-060910-5804-99&tabid=2;
classtype:trojan-activity;
sid:2013042; rev:8;
metadata:created_at 2011_06_16, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_05_22;
)