ET MOBILE_MALWARE Android/FluBot Trojan Sending Information (POST)

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MOBILE_MALWARE Android/FluBot Trojan Sending Information (POST)";
    flow:established,to_server;
    http.request_line;
    content:"POST /p.php HTTP/1.1"; fast_pattern;
    http.user_agent;
    content:"Dalvik/"; startswith;
    http.header_names;
    content:!"Referer";
    http.host;
    pcre:"/^[a-z]{15}\.(?:ru|su|cn)$/";
    reference:md5,a65d00f3688dc02e2544e02eb57a06c1;
    reference:url,www.f5.com/labs/articles/threat-intelligence/flubots-authors-employ-creative-and-sophisticated-techniques-to-achieve-their-goals-in-version-50-and-beyond;
    classtype:trojan-activity;
    sid:2034913; rev:1;
    metadata:attack_target Mobile_Client, created_at 2022_01_13, deployment Perimeter, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_01_13;
)