alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android FastViewer Variant Check-In (GET)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".php?ati=Kur-"; fast_pattern; http.user_agent; content:"|3b 20|Android"; http.header_names; to_lowercase; content:!"|0d 0a|referer|0d 0a|"; reference:md5,1315ac032903371e6e1be2f06875c117; reference:url,medium.com/s2wblog/fastviewer-variant-merged-with-fastspy-and-disguised-as-a-legitimate-mobile-application-f3004588f95c; classtype:trojan-activity; sid:2050687; rev:2; metadata:attack_target Mobile_Client, created_at 2024_02_02, deployment Perimeter, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_27; target:src_ip;)