alert dns $HOME_NET any -> any any (msg:"ET MALWARE TR/Spy.Gen checkin via dns ANY query"; dns.query; content:"ianxz6zefk72ulzz.onion"; depth:22; reference:url,mwanalysis.org/?page=report&analysisid=430235&password=wwgcvyheon; reference:url,anubis.iseclab.org/?action=result&task_id=1623d5fd288be7024e56c5bd38359c33c; reference:md5,2519bdb5459bc9f59f59cd7ccb147d23; classtype:command-and-control; sid:2013516; rev:5; metadata:created_at 2011_09_02, deprecation_reason Duplicate, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_06_27;)