alert dns $HOME_NET any -> any any (msg:"ET MOBILE_MALWARE WireX Botnet DNS Lookup"; dns.query; content:"axclick.store"; depth:13; fast_pattern; endswith; nocase; reference:md5,6af299a2ac9b59f7d551b6e235e0d200; reference:url,blog.cloudflare.com/the-wirex-botnet/; classtype:trojan-activity; sid:2024615; rev:6; metadata:affected_product Android, attack_target Mobile_Client, created_at 2017_08_28, deployment Perimeter, malware_family Android_WireX, confidence Medium, signature_severity Major, tag Android, updated_at 2020_09_17;)