ET MOBILE_MALWARE PJobRat System Exfil to CnC

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MOBILE_MALWARE PJobRat System Exfil to CnC";
    flow:to_server,established;
    http.method;
    content:"POST";
    http.request_body;
    content:"|7b 22|network|22 3a 22|";
    content:"|22 2c 22|type|22 3a 22 5b|";
    content:"|22 2c 22|info|22 3a 22|";
    content:"|22 2c 22|ipaddr|22 3a 22|";
    content:"|22 2c 22|bandwidth|22 3a 22|";
    content:"|22 2c 22|downspeed|22 3a 22|";
    content:"|22 2c 22|upspeed|22 3a 22|";
    content:"|22 2c 22|rip|22 3a 22|";
    content:"|22 2c 22|manufacture|22 3a 22|";
    content:"|22 2c 22|imei|22 3a 22|";
    content:"|22 2c 22|pnumber|22 3a 22|";
    content:"|22 2c 22|location|22 3a 22 5b 7b 5c 22|latitude|5c 22 3a 5c 22|"; fast_pattern;
    content:"|22 2c 22|appname|22 3a 22|";
    reference:url,labs.k7computing.com/?p=22537;
    classtype:command-and-control;
    sid:2033319; rev:1;
    metadata:affected_product Android, created_at 2021_07_13, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_07_13;
)