alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Unknown Landing URI Nov 17 2016"; flow:established,to_server; http.uri; content:"/kt/JpNx9n"; endswith; reference:url,labs.sucuri.net/?note=2016-11-17; classtype:trojan-activity; sid:2023532; rev:4; metadata:affected_product Android, attack_target Mobile_Client, created_at 2016_11_18, deployment Perimeter, confidence Medium, signature_severity Major, tag Android, updated_at 2024_03_19;)