alert dns any any -> any any (msg:"🐾 - ☠ DNS request 🌐 - 🎛 C2 🐀 NanoCore RAT"; flow:to_server, stateless; dns_query; content:"whois.dzbc.org"; nocase; reference:url,https://twitter.com/ScumBots/status/1287051817537372160; reference:url,https://malpedia.caad.fkie.fraunhofer.de/details/win.nanocore; metadata:created_at 2020_07_26, updated_at 2020_07_26; sid:3312455; rev:1; classtype:trojan-activity;)