ET MOBILE_MALWARE Fake Rocket Alerts App Sending Phone Information (POST)

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MOBILE_MALWARE Fake Rocket Alerts App Sending Phone Information (POST)";
    flow:established,to_server;
    urilen:9;
    http.method;
    content:"POST";
    http.uri;
    content:"/file.php";
    http.content_type;
    content:"multipart/form-data|3b|boundary="; startswith; fast_pattern;
    http.host;
    pcre:"/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/";
    http.header;
    pcre:"/^file\x3a\x20[^\r\n]+\x2efinal\r\n/Hm";
    http.header_names;
    content:!"Referer";
    http.request_body;
    content:"form-data|3b 20|name=|22|file|22 3b|filename=|22|";
    reference:url,blog.cloudflare.com/malicious-redalert-rocket-alerts-application-targets-israeli-phone-calls-sms-and-user-information/;
    reference:md5,410c6e3af93abde8a8c7801cb14da9e0;
    classtype:trojan-activity;
    sid:2049628; rev:1;
    metadata:attack_target Mobile_Client, created_at 2023_12_08, deployment Perimeter, performance_impact Low, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_12_08;
    target:src_ip;
)