# SIGS: Android/TrickMo.Banker

**URL:** <https://community.emergingthreats.net/t/sigs-android-trickmo-banker/2086>\
**Category:** Rule Signatures\
**Created:** [October 29, 2024, 2:46pm UTC](https://community.emergingthreats.net/t/sigs-android-trickmo-banker/2086 "2024-10-29T14:46:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kevross33](https://avatars.discourse-cdn.com/v4/letter/k/82dd89/32.png) [@kevross33](https://community.emergingthreats.net/u/kevross33)\
**Post date:** [October 29, 2024, 2:46pm UTC](https://community.emergingthreats.net/t/sigs-android-trickmo-banker/2086/1 "2024-10-29T14:46:53Z")

</div>

alert tcp $HOME\_NET any → $EXTERNAL\_NET $HTTP\_PORTS (msg:“ET MOBILE\_MALWARE Android/TrickMo.Banker POST Request”; flow:established,to\_server; content:“POST”; http\_method; content:“|22|id|22|”; http\_client\_body; content:“|22|imsi|22|”; http\_client\_body; distance:0; content:“|22|imei|22|”; http\_client\_body; distance:0; content:“|22|phone|22|”; http\_client\_body; distance:0; content:“|22|operator|22|”; http\_client\_body; distance:0; content:“|22|aid|22|”; http\_client\_body; distance:0; content:“|22|model|22|”; http\_client\_body; distance:0; content:“|22|brand|22|”; http\_client\_body; distance:0; content:“|22|version|22|”; http\_client\_body; distance:0; content:“|22|build|22|”; http\_client\_body; distance:0; content:“|22|battery|22|”; http\_client\_body; distance:0; content:“|22|wifi|22|”; http\_client\_body; distance:0; content:“|22|w\_time|22|”; http\_client\_body; distance:0; content:“|22|smsApp|22|”; http\_client\_body; distance:0; content:“|22|smsAppPackage|22|”; http\_client\_body; distance:0; content:“|22|clickerConfig|22|”; http\_client\_body; distance:0; content:“|22|signal|22|”; http\_client\_body; distance:0; content:“|22|installedApps|22|”; http\_client\_body; distance:0; classtype:trojan-activity; reference:url,[A new TrickMo saga: from Banking Trojan to Victim's Data Leak | Cleafy Labs](http://www.cleafy.com/cleafy-labs/a-new-trickmo-saga-from-banking-trojan-to-victims-data-leak); sid:132111; rev:1;)  
alert tcp $HOME\_NET any → $EXTERNAL\_NET $HTTP\_PORTS (msg:“ET MOBILE\_MALWARE Android/TrickMo.Banker GET Config Request”; flow:established,to\_server; content:“GET”; http\_method; content:“/config?hash=”; http\_uri; depth:13; content:“AID|3A| “; http\_header; flowbits:set,et.trickmoconfig; classtype:trojan-activity; reference:url,[A new TrickMo saga: from Banking Trojan to Victim's Data Leak | Cleafy Labs](http://www.cleafy.com/cleafy-labs/a-new-trickmo-saga-from-banking-trojan-to-victims-data-leak); sid:132112; rev:1;)  
alert tcp $EXTERNAL\_NET $HTTP\_PORTS → $HOME\_NET any (msg:“ET MOBILE\_MALWARE Android/TrickMo.Banker Config Response”; flow:established,to\_client; flowbits:isset,et.trickmoconfig; file\_data; content:”|22|name|22|”; distance:0; content:“|22|eventPackageName|22|”; distance:0; content:“|22|filters|22|”; distance:0; content:“|22|actions|22|”; distance:0; classtype:trojan-activity; reference:url,[A new TrickMo saga: from Banking Trojan to Victim's Data Leak | Cleafy Labs](http://www.cleafy.com/cleafy-labs/a-new-trickmo-saga-from-banking-trojan-to-victims-data-leak); sid:132113; rev:1;)

Kind Regards,  
Kevin Ross

---

<div class="post-metadata">

**Author:** ![trobinson667](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/trobinson667/32/544_2.png) [@trobinson667](https://community.emergingthreats.net/u/trobinson667)\
**Post date:** [October 29, 2024, 5:36pm UTC](https://community.emergingthreats.net/t/sigs-android-trickmo-banker/2086/2 "2024-10-29T17:36:49Z")

</div>

Greetings and Thank you very much for your rule submission. I’ve made some slight changes here and there for better perf/compatibility with suri 4 through suri 7, but otherwise, please look forward towards these rules being present in tonight’s rule release.

Cheers,

Tony

---

<div class="post-metadata">

**Author:** ![rgonzalez](https://avatars.discourse-cdn.com/v4/letter/r/bc79bd/32.png) [@rgonzalez](https://community.emergingthreats.net/u/rgonzalez)\
**Post date:** [October 29, 2024, 7:10pm UTC](https://community.emergingthreats.net/t/sigs-android-trickmo-banker/2086/3 "2024-10-29T19:10:46Z")

</div>

Thanks @kevross33 @trobinson667 !