alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Andr/com.sdwiurse"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/youxi_up.php"; fast_pattern; http.request_body; content:"--*****|0d 0a|Content-Disposition|3a 20|form-data|3b 20|name=|22|npki|22|"; startswith; reference:url,fireeye.com/blog/technical/2014/06/what-are-you-doing-dsencrypt-malware.html; reference:md5,04d24eb45d3278400b5fee5c1b06226c; classtype:trojan-activity; sid:2018584; rev:6; metadata:created_at 2014_06_20, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_13;)