alert http1 $HOME_NET any -> $EXTERNAL_NET 8511 (msg:"ET MOBILE_MALWARE DroidKungFu Variant"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/search/"; content:".php?i="; distance:0; http.protocol; content:"HTTP/1.0"; http.user_agent; bsize:7; content:"unknown"; fast_pattern; http.header_names; bsize:16; content:"|0d 0a|User-Agent|0d 0a 0d 0a|"; classtype:trojan-activity; sid:2016345; rev:7; metadata:created_at 2013_02_05, signature_severity Major, updated_at 2024_04_07;)