alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain advanbusiness.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"advanbusiness|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es; classtype:trojan-activity; sid:80040000; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain aoldaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"aoldaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040001; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain aolon1ine.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"aolon1ine|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040002; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain applesoftupdate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"applesoftupdate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040003; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040004; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain attnpower.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"attnpower|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040005; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain aunewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"aunewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040006; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain avvmail.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"avvmail|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040007; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040008; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040009; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain blackberrycluter.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"blackberrycluter|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040010; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040011; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bluecoate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bluecoate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040012; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain booksonlineclub.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"booksonlineclub|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040013; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bpyoyo.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bpyoyo|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040014; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040015; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain businessformars.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"businessformars|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040016; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain busketball.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"busketball|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040017; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain canadatvsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"canadatvsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040018; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain canoedaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"canoedaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040019; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain chileexe77.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"chileexe77|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040020; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cnndaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cnndaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040021; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cnndaily.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cnndaily|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040022; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cnnnewsdaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cnnnewsdaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040023; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cometoway.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cometoway|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040024; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain companyinfosite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"companyinfosite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040025; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain competrip.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"competrip|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040026; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain comrepair.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"comrepair|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040027; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain conferencesinfo.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"conferencesinfo|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040028; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain copporationnews.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"copporationnews|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040029; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cslisten.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cslisten|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040030; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain defenceonline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"defenceonline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040031; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain dnsweb.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"dnsweb|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040032; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain downloadsite.me"; flow:to_server; byte_test:1,!&,0xF8,2; content:"downloadsite|03|me|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040033; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040034; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain e-cardsshop.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"e-cardsshop|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040035; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040036; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain freshreaders.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"freshreaders|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040037; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain giftnews.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"giftnews|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040038; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain globalowa.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"globalowa|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040039; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain gmailboxes.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"gmailboxes|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040040; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain hkcastte.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"hkcastte|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040041; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040042; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain hvmetal.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"hvmetal|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040043; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain idirectech.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"idirectech|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040044; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ifexcel.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ifexcel|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040045; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain infobusinessus.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"infobusinessus|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040046; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040047; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain issnbgkit.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"issnbgkit|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040048; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain jobsadvanced.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"jobsadvanced|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040049; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain livemymsn.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"livemymsn|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040050; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain lksoftvc.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"lksoftvc|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040051; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain maltempata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"maltempata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040052; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain marsbrother.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"marsbrother|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040053; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mcafeepaying.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mcafeepaying|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040054; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mediaxsds.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mediaxsds|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040055; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain microsoft-update-info.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"microsoft-update-info|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040056; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain micyuisyahooapis.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"micyuisyahooapis|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040057; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040058; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain myyahoonews.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"myyahoonews|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040059; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain nationtour.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"nationtour|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040060; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain newsesport.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"newsesport|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040061; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040062; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain newsonlinesite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"newsonlinesite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040063; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain newspappers.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"newspappers|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040064; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain nirvanaol.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"nirvanaol|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040065; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ns06.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ns06|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040066; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain nytimesnews.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"nytimesnews|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040067; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain olmusic100.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"olmusic100|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040068; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain onefastgame.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"onefastgame|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040069; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain oplaymagzine.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"oplaymagzine|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040070; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pcclubddk.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pcclubddk|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040071; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain phoenixtvus.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"phoenixtvus|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040072; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop-musicsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop-musicsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040073; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain progammerli.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"progammerli|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040074; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040075; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain regicsgf.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"regicsgf|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040076; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain reutersnewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"reutersnewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040077; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain rssadvanced.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"rssadvanced|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040078; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain safalife.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"safalife|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040079; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain saltlakenews.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"saltlakenews|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040080; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain satellitebbs.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"satellitebbs|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040081; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain searchforca.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"searchforca|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040082; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain shepmas.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"shepmas|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040083; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain skyswim.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"skyswim|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040084; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain softsolutionbox.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"softsolutionbox|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040085; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sportreadok.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sportreadok|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040086; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain staycools.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"staycools|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040087; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain symanteconline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"symanteconline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040088; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain syscation.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"syscation|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040089; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain syscation.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"syscation|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040090; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain tfxdccssl.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"tfxdccssl|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040091; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain thehealthmood.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"thehealthmood|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040092; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain tibethome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"tibethome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040093; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain todayusa.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"todayusa|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040094; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain usabbs.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"usabbs|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040095; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain usapappers.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"usapappers|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040096; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ushongkong.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ushongkong|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040097; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain usnewssite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"usnewssite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040098; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain usnftc.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"usnftc|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040099; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ustvb.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ustvb|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040100; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain uszzcs.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"uszzcs|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040101; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain voiceofman.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"voiceofman|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040102; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain webservicesupdate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"webservicesupdate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040103; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain worthhummer.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"worthhummer|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040104; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain yahoodaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"yahoodaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040105; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain youipcam.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"youipcam|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040106; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain 08elec.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"08elec|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040107; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain 09back.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"09back|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040108; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain 3ml.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"3ml|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040109; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain 3pma.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"3pma|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040110; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain 4cback.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"4cback|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040111; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain 7cback.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"7cback|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040112; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain 911.cnnnewsdaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"911|03|cnnnewsdaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040113; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain a-ad.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"a-ad|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040114; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain a-af.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"a-af|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040115; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain aam.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"aam|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040116; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain aar.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"aar|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040117; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain aarco.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"aarco|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040118; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain a-bne.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"a-bne|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040119; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain abs.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"abs|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040120; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain acer.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"acer|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040121; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain acli-mail.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"acli-mail|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040122; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain a-co.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"a-co|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040123; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain acu.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"acu|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040124; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain adb.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"adb|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040125; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain add.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"add|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040126; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain addr.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"addr|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040127; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain adi002.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"adi002|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040128; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain a-dl.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"a-dl|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040129; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain admin.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"admin|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040130; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain admin.datastorage01.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"admin|03|datastorage01|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040131; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain admin.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"admin|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040132; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain admin.softsolutionbox.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"admin|03|softsolutionbox|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040133; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain adobe.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"adobe|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040134; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ads.bpyoyo.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ads|03|bpyoyo|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040135; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain adt.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"adt|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040136; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain adt001.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"adt001|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040137; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain adt002.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"adt002|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040138; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain adtk.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"adtk|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040139; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain adtkl.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"adtkl|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040140; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain adtkl.gmailboxes.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"adtkl|03|gmailboxes|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040141; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain adtlk.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"adtlk|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040142; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ae.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ae|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040143; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain a-ec.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"a-ec|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040144; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain a-ep.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"a-ep|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040145; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain aero.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"aero|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040146; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain aes.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"aes|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040147; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain a-ex.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"a-ex|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040148; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain af.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"af|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040149; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain afda.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"afda|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040150; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain a-fj.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"a-fj|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040151; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain africa.mcafeepaying.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"africa|03|mcafeepaying|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040152; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain africa.todayusa.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"africa|03|todayusa|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040153; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain africa.usabbs.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"africa|03|usabbs|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040154; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain africadb.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"africadb|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040155; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain afw.globalowa.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"afw|03|globalowa|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040156; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain a-ga.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"a-ga|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040157; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain agl.softsolutionbox.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"agl|03|softsolutionbox|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040158; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ago.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ago|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040159; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain a-gon.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"a-gon|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040160; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain a-he.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"a-he|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040161; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain a-he.softsolutionbox.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"a-he|03|softsolutionbox|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040162; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain a-if.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"a-if|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040163; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain a-iho.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"a-iho|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040164; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain aiic.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"aiic|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040165; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain aip.comrepair.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"aip|03|comrepair|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040166; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain airline.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"airline|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040167; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain airplane.defenceonline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"airplane|03|defenceonline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040168; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ait.busketball.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ait|03|busketball|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040169; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain a-ja.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"a-ja|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040170; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain a-jsm.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"a-jsm|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040171; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain a-jsm.infobusinessus.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"a-jsm|03|infobusinessus|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040172; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ak47.infobusinessus.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ak47|03|infobusinessus|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040173; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ak47.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ak47|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040174; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain alarm.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"alarm|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040175; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain alarm.infobusinessus.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"alarm|03|infobusinessus|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040176; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain alcan.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"alcan|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040177; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain alion.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"alion|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040178; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain alone.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"alone|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040179; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain amanda.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"amanda|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040180; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain amne.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"amne|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040181; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ams.busketball.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ams|03|busketball|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040182; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain amusement.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"amusement|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040183; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain analysis.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"analysis|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040184; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain anglo.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"anglo|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040185; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain anti.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"anti|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040186; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain aol.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"aol|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040187; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain a-ol.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"a-ol|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040188; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain aol.infobusinessus.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"aol|03|infobusinessus|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040189; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain aol.softsolutionbox.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"aol|03|softsolutionbox|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040190; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain aon.infobusinessus.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"aon|03|infobusinessus|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040191; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain a-ov.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"a-ov|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040192; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain apa.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"apa|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040193; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain apa.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"apa|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040194; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain apa.safalife.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"apa|03|safalife|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040195; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain apejack.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"apejack|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040196; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain apekl.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"apekl|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040197; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain a-pep.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"a-pep|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040198; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain app.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"app|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040199; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain app.infobusinessus.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"app|03|infobusinessus|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040200; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain apple.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"apple|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040201; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain apple.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"apple|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040202; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain apple.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"apple|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040203; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain apple.rssadvanced.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"apple|03|rssadvanced|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040204; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain aps.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"aps|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040205; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain apss.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"apss|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040206; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain apss.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"apss|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040207; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ara.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ara|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040208; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ara.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ara|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040209; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ara2.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ara2|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040210; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ara2.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ara2|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040211; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain arainfo.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"arainfo|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040212; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain arainfo.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"arainfo|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040213; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain a-rdr.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"a-rdr|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040214; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ares.aunewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ares|03|aunewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040215; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain argsafhq.blackberrycluter.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"argsafhq|03|blackberrycluter|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040216; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain a-ri.comrepair.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"a-ri|03|comrepair|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040217; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain armi.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"armi|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040218; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain army.newsonlinesite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"army|03|newsonlinesite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040219; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain army.todayusa.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"army|03|todayusa|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040220; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ascn.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ascn|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040221; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain asiv.softsolutionbox.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"asiv|03|softsolutionbox|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040222; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain asp.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"asp|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040223; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain asp.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"asp|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040224; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain asp.busketball.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"asp|03|busketball|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040225; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain asp.softsolutionbox.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"asp|03|softsolutionbox|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040226; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ass.globalowa.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ass|03|globalowa|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040227; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain astone.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"astone|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040228; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain atm.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"atm|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040229; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain atom.busketball.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"atom|03|busketball|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040230; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain a-uac.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"a-uac|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040231; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain a-un.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"a-un|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040232; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ausi.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ausi|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040233; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain auto.aoldaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"auto|03|aoldaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040234; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain auto.companyinfosite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"auto|03|companyinfosite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040235; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain auto.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"auto|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040236; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain auto.gmailboxes.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"auto|03|gmailboxes|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040237; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain auto.livemymsn.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"auto|03|livemymsn|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040238; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain auto.mcafeepaying.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"auto|03|mcafeepaying|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040239; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain auto.myyahoonews.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"auto|03|myyahoonews|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040240; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain avast.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"avast|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040241; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain avph.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"avph|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040242; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain a-za.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"a-za|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040243; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain a-za.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"a-za|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040244; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain a-zx.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"a-zx|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040245; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain b.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"b|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040246; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bab.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bab|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040247; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain back.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"back|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040248; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain back.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"back|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040249; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain back.infobusinessus.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"back|03|infobusinessus|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040250; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain back.worthhummer.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"back|03|worthhummer|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040251; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain backsun.busketball.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"backsun|03|busketball|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040252; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain backup.infobusinessus.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"backup|03|infobusinessus|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040253; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain backup.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"backup|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040254; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain backup.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"backup|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040255; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain backupsw.infobusinessus.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"backupsw|03|infobusinessus|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040256; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain banner.infobusinessus.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"banner|03|infobusinessus|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040257; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain barity.gmailboxes.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"barity|03|gmailboxes|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040258; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain basketball.todayusa.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"basketball|03|todayusa|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040259; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bass.busketball.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bass|03|busketball|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040260; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bat.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bat|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040261; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bat.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bat|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040262; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bat.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bat|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040263; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bat.safalife.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bat|03|safalife|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040264; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bbb.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bbb|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040265; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bbh.dnsweb.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bbh|03|dnsweb|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040266; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bbs.busketball.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bbs|03|busketball|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040267; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bbs.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bbs|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040268; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bbsfu.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bbsfu|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040269; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bcc.blackberrycluter.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bcc|03|blackberrycluter|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040270; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bcc.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bcc|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040271; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bcc.infobusinessus.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bcc|03|infobusinessus|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040272; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bee.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bee|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040273; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bee.newspappers.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bee|03|newspappers|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040274; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bee.usapappers.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bee|03|usapappers|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040275; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bg-g.comrepair.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bg-g|03|comrepair|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040276; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bhbt.infobusinessus.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bhbt|03|infobusinessus|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040277; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bhbt.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bhbt|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040278; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bing.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bing|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040279; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bitdefender.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bitdefender|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040280; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bkav.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bkav|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040281; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bkav2007.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bkav2007|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040282; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bksy.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bksy|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040283; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain black.infobusinessus.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"black|03|infobusinessus|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040284; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain black.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"black|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040285; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain blackfish.defenceonline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"blackfish|03|defenceonline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040286; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bll.dnsweb.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bll|03|dnsweb|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040287; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain blog.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"blog|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040288; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain blog.busketball.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"blog|03|busketball|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040289; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain blog.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"blog|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040290; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain blog.regicsgf.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"blog|03|regicsgf|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040291; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain blow.reutersnewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"blow|03|reutersnewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040292; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain blue.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"blue|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040293; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bluefin.aunewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bluefin|03|aunewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040294; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bmi.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bmi|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040295; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bob.dnsweb.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bob|03|dnsweb|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040296; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bobo.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bobo|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040297; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bobo.oplaymagzine.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bobo|03|oplaymagzine|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040298; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain book.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"book|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040299; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain book.pop-musicsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"book|03|pop-musicsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040300; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain book.reutersnewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"book|03|reutersnewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040301; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bot.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bot|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040302; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bourne.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bourne|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040303; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bphb.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bphb|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040304; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bring.busketball.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bring|03|busketball|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040305; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain brog.regicsgf.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"brog|03|regicsgf|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040306; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain bswt.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"bswt|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040307; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain built.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"built|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040308; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain business.aunewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"business|03|aunewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040309; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain business.chileexe77.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"business|03|chileexe77|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040310; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain business.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"business|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040311; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain business.jobsadvanced.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"business|03|jobsadvanced|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040312; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain business.satellitebbs.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"business|03|satellitebbs|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040313; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain business.yahoodaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"business|03|yahoodaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040314; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain buy.infobusinessus.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"buy|03|infobusinessus|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040315; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain buy.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"buy|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040316; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain buycow.busketball.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"buycow|03|busketball|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040317; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain buyer.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"buyer|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040318; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain buz.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"buz|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040319; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain c.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"c|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040320; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain caaid.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"caaid|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040321; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cac.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cac|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040322; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cac.worthhummer.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cac|03|worthhummer|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040323; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cache.aolon1ine.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cache|03|aolon1ine|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040324; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cacq.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cacq|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040325; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cadfait.softsolutionbox.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cadfait|03|softsolutionbox|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040326; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cais.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cais|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040327; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cais.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cais|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040328; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain can.infobusinessus.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"can|03|infobusinessus|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040329; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain canada.cnndaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"canada|03|cnndaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040330; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain canary.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"canary|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040331; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cappuccino.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cappuccino|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040332; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain car1.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"car1|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040333; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain care.jobsadvanced.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"care|03|jobsadvanced|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040334; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain care.satellitebbs.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"care|03|satellitebbs|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040335; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cars.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cars|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040336; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain carvin.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"carvin|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040337; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain catalog.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"catalog|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040338; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ccsukl.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ccsukl|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040339; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cdc01.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cdc01|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040340; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cdcd.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cdcd|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040341; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cdd.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cdd|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040342; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cdrnkl.worthhummer.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cdrnkl|03|worthhummer|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040343; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cecilia.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cecilia|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040344; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ce-ip.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ce-ip|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040345; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain center.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"center|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040346; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain center.busketball.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"center|03|busketball|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040347; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain center.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"center|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040348; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ceros.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ceros|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040349; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cetv.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cetv|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040350; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain chat.infobusinessus.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"chat|03|infobusinessus|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040351; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain chat.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"chat|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040352; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain check.staycools.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"check|03|staycools|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040353; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain check.thehealthmood.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"check|03|thehealthmood|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040354; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain chicken.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"chicken|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040355; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain chicken.pop-musicsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"chicken|03|pop-musicsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040356; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain chivas.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"chivas|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040357; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain chq.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"chq|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040358; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain christitannahill.appspot.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"christitannahill|03|appspot|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040359; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cib.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cib|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040360; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cibuc.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cibuc|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040361; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain citrix.globalowa.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"citrix|03|globalowa|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040362; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain citt.downloadsite.me"; flow:to_server; byte_test:1,!&,0xF8,2; content:"citt|03|downloadsite|03|me|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040363; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain city.gmailboxes.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"city|03|gmailboxes|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040364; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain class.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"class|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040365; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain client.infobusinessus.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"client|03|infobusinessus|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040366; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain climate.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"climate|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040367; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain climate.oplaymagzine.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"climate|03|oplaymagzine|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040368; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain clin.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"clin|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040369; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cman.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cman|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040370; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cmp.gmailboxes.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cmp|03|gmailboxes|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040371; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cobh.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cobh|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040372; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain coco.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"coco|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040373; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain code.jobsadvanced.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"code|03|jobsadvanced|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040374; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain code.mcafeepaying.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"code|03|mcafeepaying|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040375; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain coe.nationtour.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"coe|03|nationtour|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040376; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain coe.reutersnewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"coe|03|reutersnewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040377; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain coer.reutersnewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"coer|03|reutersnewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040378; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cok.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cok|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040379; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain com.conferencesinfo.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"com|03|conferencesinfo|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040380; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain comfile.softsolutionbox.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"comfile|03|softsolutionbox|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040381; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain commpany.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"commpany|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040382; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain company.canadatvsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"company|03|canadatvsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040383; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain compfile.softsolutionbox.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"compfile|03|softsolutionbox|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040384; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain compu.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"compu|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040385; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain compute.satellitebbs.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"compute|03|satellitebbs|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040386; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain conn.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"conn|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040387; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain contact.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"contact|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040388; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain contact.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"contact|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040389; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain contact.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"contact|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040390; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain contact.jobsadvanced.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"contact|03|jobsadvanced|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040391; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain contact.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"contact|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040392; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain contact.yahoodaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"contact|03|yahoodaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040393; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain content.cnnnewsdaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"content|03|cnnnewsdaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040394; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain control.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"control|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040395; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain control.blackberrycluter.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"control|03|blackberrycluter|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040396; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cook.globalowa.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cook|03|globalowa|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040397; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cool.infobusinessus.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cool|03|infobusinessus|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040398; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cool.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cool|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040399; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain corn.busketball.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"corn|03|busketball|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040400; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain corp.booksonlineclub.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"corp|03|booksonlineclub|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040401; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain corp.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"corp|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040402; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cost.cnnnewsdaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cost|03|cnnnewsdaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040403; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain count.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"count|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040404; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain country.canadatvsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"country|03|canadatvsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040405; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cow.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cow|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040406; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cowboy.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cowboy|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040407; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cowboy.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cowboy|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040408; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain crab.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"crab|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040409; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain crab.infobusinessus.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"crab|03|infobusinessus|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040410; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain crab.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"crab|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040411; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain crackling123.appspot.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"crackling123|03|appspot|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040412; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cross.busketball.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cross|03|busketball|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040413; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain crz.dnsweb.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"crz|03|dnsweb|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040414; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cs.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cs|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040415; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain csch.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"csch|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040416; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain csupp.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"csupp|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040417; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ctcn.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ctcn|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040418; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ctcs.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ctcs|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040419; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ctcs.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ctcs|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040420; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ctimoon.marsbrother.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ctimoon|03|marsbrother|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040421; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ctisk.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ctisk|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040422; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cubbh.newspappers.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cubbh|03|newspappers|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040423; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cubh.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cubh|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040424; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain culture.chileexe77.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"culture|03|chileexe77|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040425; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cure.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cure|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040426; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain current.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"current|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040427; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cw.e-cardsshop.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cw|03|e-cardsshop|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040428; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cw.mcafeepaying.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cw|03|mcafeepaying|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040429; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cw.nationtour.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cw|03|nationtour|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040430; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cw.pop-musicsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cw|03|pop-musicsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040431; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cw.searchforca.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cw|03|searchforca|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040432; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cwe.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cwe|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040433; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cwe80.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cwe80|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040434; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cwel.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cwel|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040435; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain cws.gmailboxes.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"cws|03|gmailboxes|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040436; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain d.bpyoyo.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"d|03|bpyoyo|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040437; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain da.comrepair.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"da|03|comrepair|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040438; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain daa.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"daa|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040439; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain daily.newsonlinesite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"daily|03|newsonlinesite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040440; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain data.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"data|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040441; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain date.freshreaders.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"date|03|freshreaders|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040442; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain date.gmailboxes.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"date|03|gmailboxes|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040443; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain date.rssadvanced.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"date|03|rssadvanced|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040444; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain date.voiceofman.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"date|03|voiceofman|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040445; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain datehelp.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"datehelp|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040446; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain dating.satellitebbs.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"dating|03|satellitebbs|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040447; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain db.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"db|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040448; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain default.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"default|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040449; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain defense.usabbs.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"defense|03|usabbs|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040450; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain del.advanbusiness.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"del|03|advanbusiness|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040451; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain demo.myyahoonews.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"demo|03|myyahoonews|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040452; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain den.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"den|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040453; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain denel.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"denel|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040454; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain densun.comrepair.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"densun|03|comrepair|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040455; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain des.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"des|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040456; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain des.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"des|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040457; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain develop.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"develop|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040458; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain dhfx.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"dhfx|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040459; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain dias.globalowa.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"dias|03|globalowa|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040460; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain digi.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"digi|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040461; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain dith.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"dith|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040462; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain dl.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"dl|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040463; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain dlkl.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"dlkl|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040464; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain dnn.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"dnn|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040465; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain dns.chileexe77.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"dns|03|chileexe77|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040466; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain dns.infobusinessus.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"dns|03|infobusinessus|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040467; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain dns.issnbgkit.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"dns|03|issnbgkit|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040468; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain dns.progammerli.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"dns|03|progammerli|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040469; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain dns.webservicesupdate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"dns|03|webservicesupdate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040470; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain dns1.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"dns1|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040471; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain dnsg.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"dnsg|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040472; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain do.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"do|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040473; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain doa.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"doa|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040474; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain docu.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"docu|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040475; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain documents.aoldaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"documents|03|aoldaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040476; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain documents.aunewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"documents|03|aunewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040477; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain documents.busketball.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"documents|03|busketball|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040478; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain documents.cnndaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"documents|03|cnndaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040479; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain documents.downloadsite.me"; flow:to_server; byte_test:1,!&,0xF8,2; content:"documents|03|downloadsite|03|me|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040480; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain documents.e-cardsshop.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"documents|03|e-cardsshop|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040481; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain documents.nationtour.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"documents|03|nationtour|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040482; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain documents.voiceofman.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"documents|03|voiceofman|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040483; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain dod.dnsweb.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"dod|03|dnsweb|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040484; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain doekl.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"doekl|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040485; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain domain.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"domain|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040486; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain domain.busketball.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"domain|03|busketball|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040487; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain domain.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"domain|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040488; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain dorkia.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"dorkia|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040489; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain dot.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"dot|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040490; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain dotnet.safalife.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"dotnet|03|safalife|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040491; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain dove.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"dove|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040492; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain down.infobusinessus.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"down|03|infobusinessus|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040493; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain down.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"down|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040494; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain down.safalife.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"down|03|safalife|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040495; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain download.applesoftupdate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"download|03|applesoftupdate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040496; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain download.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"download|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040497; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain download.freshreaders.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"download|03|freshreaders|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040498; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain download.gmailboxes.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"download|03|gmailboxes|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040499; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain download.idirectech.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"download|03|idirectech|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040500; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain download.symanteconline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"download|03|symanteconline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040501; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain download.voiceofman.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"download|03|voiceofman|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040502; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain downloads.applesoftupdate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"downloads|03|applesoftupdate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040503; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain downupdate.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"downupdate|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040504; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain dp.booksonlineclub.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"dp|03|booksonlineclub|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040505; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain dq.booksonlineclub.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"dq|03|booksonlineclub|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040506; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain drb.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"drb|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040507; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain drinkwater.gmailboxes.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"drinkwater|03|gmailboxes|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040508; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain drop.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"drop|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040509; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain dsh.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"dsh|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040510; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain dsw.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"dsw|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040511; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain dvid.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"dvid|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040512; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain dvid.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"dvid|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040513; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain dvn.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"dvn|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040514; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain dyn.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"dyn|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040515; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain dyn.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"dyn|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040516; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain dyns.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"dyns|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040517; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain e.advanbusiness.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"e|03|advanbusiness|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040518; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain e.aoldaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"e|03|aoldaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040519; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain e.applesoftupdate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"e|03|applesoftupdate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040520; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain e.aunewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"e|03|aunewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040521; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain e.canoedaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"e|03|canoedaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040522; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain e.cnndaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"e|03|cnndaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040523; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain e.ifexcel.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"e|03|ifexcel|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040524; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain e.microsoft-update-info.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"e|03|microsoft-update-info|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040525; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain e.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"e|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040526; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain e.reutersnewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"e|03|reutersnewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040527; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain e.satellitebbs.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"e|03|satellitebbs|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040528; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain e.staycools.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"e|03|staycools|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040529; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain e.todayusa.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"e|03|todayusa|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040530; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain e.usabbs.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"e|03|usabbs|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040531; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain e.usapappers.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"e|03|usapappers|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040532; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain e.usnewssite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"e|03|usnewssite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040533; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain e.yahoodaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"e|03|yahoodaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040534; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain eaof.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"eaof|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040535; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain east.freshreaders.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"east|03|freshreaders|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040536; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain eatbeef.gmailboxes.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"eatbeef|03|gmailboxes|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040537; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ecli-cow.infobusinessus.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ecli-cow|03|infobusinessus|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040538; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain edit.aolon1ine.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"edit|03|aolon1ine|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040539; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain edu.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"edu|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040540; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain education.jobsadvanced.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"education|03|jobsadvanced|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040541; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain education.rssadvanced.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"education|03|rssadvanced|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040542; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain eeaa.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"eeaa|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040543; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain eee.reutersnewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"eee|03|reutersnewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040544; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain egcc.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"egcc|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040545; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain email.advanbusiness.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"email|03|advanbusiness|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040546; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain email.aoldaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"email|03|aoldaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040547; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain email.applesoftupdate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"email|03|applesoftupdate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040548; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain email.aunewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"email|03|aunewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040549; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain email.canadatvsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"email|03|canadatvsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040550; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain email.canoedaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"email|03|canoedaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040551; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain email.cnndaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"email|03|cnndaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040552; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain email.cnndaily.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"email|03|cnndaily|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040553; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain email.companyinfosite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"email|03|companyinfosite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040554; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain email.defenceonline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"email|03|defenceonline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040555; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain email.downloadsite.me"; flow:to_server; byte_test:1,!&,0xF8,2; content:"email|03|downloadsite|03|me|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040556; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain email.e-cardsshop.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"email|03|e-cardsshop|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040557; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain email.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"email|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040558; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain email.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"email|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040559; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain email.jobsadvanced.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"email|03|jobsadvanced|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040560; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain email.mcafeepaying.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"email|03|mcafeepaying|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040561; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain email.micyuisyahooapis.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"email|03|micyuisyahooapis|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040562; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain email.newsonlinesite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"email|03|newsonlinesite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040563; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain email.pop-musicsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"email|03|pop-musicsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040564; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain email.satellitebbs.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"email|03|satellitebbs|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040565; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain email.symanteconline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"email|03|symanteconline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040566; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain email.todayusa.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"email|03|todayusa|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040567; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain email.usabbs.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"email|03|usabbs|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040568; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain email.usapappers.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"email|03|usapappers|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040569; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain email.usnewssite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"email|03|usnewssite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040570; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain email.voiceofman.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"email|03|voiceofman|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040571; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain email.yahoodaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"email|03|yahoodaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040572; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain emam.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"emam|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040573; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain en.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"en|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040574; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain energy.e-cardsshop.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"energy|03|e-cardsshop|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040575; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain energy.mcafeepaying.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"energy|03|mcafeepaying|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040576; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain energy.nationtour.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"energy|03|nationtour|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040577; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain energy.pop-musicsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"energy|03|pop-musicsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040578; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain energy.searchforca.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"energy|03|searchforca|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040579; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain energy.usabbs.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"energy|03|usabbs|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040580; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain engine.usabbs.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"engine|03|usabbs|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040581; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain engineering.newsonlinesite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"engineering|03|newsonlinesite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040582; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain environment.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"environment|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040583; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain eoaf.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"eoaf|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040584; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain epod.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"epod|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040585; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain eu.usabbs.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"eu|03|usabbs|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040586; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain eum.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"eum|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040587; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain europa.cnndaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"europa|03|cnndaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040588; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain europe.canadatvsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"europe|03|canadatvsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040589; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ever.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ever|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040590; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain everest.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"everest|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040591; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain eye.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"eye|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040592; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain f3tel.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"f3tel|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040593; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain face.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"face|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040594; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain facebook.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"facebook|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040595; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain faq.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"faq|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040596; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fashion.cnnnewsdaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fashion|03|cnnnewsdaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040597; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fax.canadatvsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fax|03|canadatvsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040598; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fax.cnndaily.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fax|03|cnndaily|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040599; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fax.companyinfosite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fax|03|companyinfosite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040600; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fax.defenceonline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fax|03|defenceonline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040601; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fax.downloadsite.me"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fax|03|downloadsite|03|me|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040602; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fax.e-cardsshop.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fax|03|e-cardsshop|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040603; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fax.jobsadvanced.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fax|03|jobsadvanced|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040604; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fax.mcafeepaying.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fax|03|mcafeepaying|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040605; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fax.micyuisyahooapis.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fax|03|micyuisyahooapis|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040606; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fax.newsonlinesite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fax|03|newsonlinesite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040607; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fax.pop-musicsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fax|03|pop-musicsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040608; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fax.symanteconline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fax|03|symanteconline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040609; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fax.voiceofman.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fax|03|voiceofman|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040610; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fcn.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fcn|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040611; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fed.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fed|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040612; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ffej.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ffej|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040613; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ffej.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ffej|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040614; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fher.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fher|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040615; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fher.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fher|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040616; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fhh.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fhh|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040617; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain file.cnnnewsdaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"file|03|cnnnewsdaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040618; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain file.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"file|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040619; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain files.cnndaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"files|03|cnndaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040620; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain files.downloadsite.me"; flow:to_server; byte_test:1,!&,0xF8,2; content:"files|03|downloadsite|03|me|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040621; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fileshare.usabbs.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fileshare|03|usabbs|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040622; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fileyp.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fileyp|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040623; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain film.downloadsite.me"; flow:to_server; byte_test:1,!&,0xF8,2; content:"film|03|downloadsite|03|me|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040624; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fim.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fim|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040625; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fim.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fim|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040626; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain finance.aoldaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"finance|03|aoldaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040627; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain finance.aunewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"finance|03|aunewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040628; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain finance.chileexe77.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"finance|03|chileexe77|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040629; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain finance.cnnnewsdaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"finance|03|cnnnewsdaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040630; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain finance.newsonlinesite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"finance|03|newsonlinesite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040631; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain finance.staycools.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"finance|03|staycools|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040632; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain finance.thehealthmood.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"finance|03|thehealthmood|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040633; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain finance.todayusa.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"finance|03|todayusa|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040634; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain finance.usabbs.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"finance|03|usabbs|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040635; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain finance.usnewssite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"finance|03|usnewssite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040636; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain finance.yahoodaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"finance|03|yahoodaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040637; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain financial.advanbusiness.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"financial|03|advanbusiness|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040638; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fine.worthhummer.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fine|03|worthhummer|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040639; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fineca.blackberrycluter.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fineca|03|blackberrycluter|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040640; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fineca.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fineca|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040641; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain finekl.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"finekl|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040642; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain finekl.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"finekl|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040643; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain finekl.worthhummer.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"finekl|03|worthhummer|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040644; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fiona.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fiona|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040645; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fire.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fire|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040646; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fire1.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fire1|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040647; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain first.voiceofman.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"first|03|voiceofman|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040648; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fjod.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fjod|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040649; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fkfc.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fkfc|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040650; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain flash.aoldaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"flash|03|aoldaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040651; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain flash.aunewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"flash|03|aunewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040652; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain flash.cnndaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"flash|03|cnndaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040653; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain flash.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"flash|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040654; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain flash.jobsadvanced.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"flash|03|jobsadvanced|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040655; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain flash.livemymsn.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"flash|03|livemymsn|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040656; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain flash.mcafeepaying.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"flash|03|mcafeepaying|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040657; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain flash.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"flash|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040658; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain flash.usnewssite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"flash|03|usnewssite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040659; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain flash.yahoodaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"flash|03|yahoodaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040660; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain flucare.worthhummer.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"flucare|03|worthhummer|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040661; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fly.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fly|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040662; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fme.busketball.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fme|03|busketball|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040663; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain f-mi.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"f-mi|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040664; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fmp.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fmp|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040665; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fmp.worthhummer.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fmp|03|worthhummer|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040666; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fnem.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fnem|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040667; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fni.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fni|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040668; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fni.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fni|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040669; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fni.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fni|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040670; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fnpc.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fnpc|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040671; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fnrn.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fnrn|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040672; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fntel.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fntel|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040673; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fok.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fok|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040674; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain follow.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"follow|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040675; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain food.busketball.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"food|03|busketball|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040676; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain food.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"food|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040677; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain football.canoedaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"football|03|canoedaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040678; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain forum.infobusinessus.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"forum|03|infobusinessus|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040679; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain free.gmailboxes.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"free|03|gmailboxes|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040680; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain friends.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"friends|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040681; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain froum.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"froum|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040682; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fs.mcafeepaying.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fs|03|mcafeepaying|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040683; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fs.searchforca.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fs|03|searchforca|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040684; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fstl.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fstl|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040685; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fstl.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fstl|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040686; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fstl.worthhummer.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fstl|03|worthhummer|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040687; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ftp.advanbusiness.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ftp|03|advanbusiness|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040688; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ftp.aoldaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ftp|03|aoldaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040689; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ftp.applesoftupdate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ftp|03|applesoftupdate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040690; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ftp.aunewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ftp|03|aunewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040691; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ftp.bpyoyo.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ftp|03|bpyoyo|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040692; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ftp.canadatvsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ftp|03|canadatvsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040693; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ftp.canoedaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ftp|03|canoedaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040694; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ftp.cnndaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ftp|03|cnndaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040695; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ftp.cnndaily.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ftp|03|cnndaily|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040696; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ftp.companyinfosite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ftp|03|companyinfosite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040697; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ftp.defenceonline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ftp|03|defenceonline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040698; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ftp.downloadsite.me"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ftp|03|downloadsite|03|me|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040699; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ftp.e-cardsshop.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ftp|03|e-cardsshop|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040700; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ftp.jobsadvanced.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ftp|03|jobsadvanced|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040701; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ftp.mcafeepaying.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ftp|03|mcafeepaying|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040702; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ftp.micyuisyahooapis.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ftp|03|micyuisyahooapis|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040703; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ftp.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ftp|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040704; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ftp.newsonlinesite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ftp|03|newsonlinesite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040705; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ftp.pop-musicsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ftp|03|pop-musicsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040706; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ftp.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ftp|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040707; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ftp.satellitebbs.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ftp|03|satellitebbs|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040708; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ftp.staycools.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ftp|03|staycools|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040709; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ftp.symanteconline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ftp|03|symanteconline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040710; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ftp.todayusa.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ftp|03|todayusa|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040711; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ftp.usabbs.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ftp|03|usabbs|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040712; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ftp.usapappers.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ftp|03|usapappers|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040713; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ftp.ustvb.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ftp|03|ustvb|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040714; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ftp.voiceofman.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ftp|03|voiceofman|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040715; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ftph.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ftph|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040716; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ftrj.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ftrj|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040717; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fuck.reutersnewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fuck|03|reutersnewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040718; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fun.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fun|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040719; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain function.canadatvsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"function|03|canadatvsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040720; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain function.symanteconline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"function|03|symanteconline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040721; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain funny.canadatvsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"funny|03|canadatvsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040722; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain funny.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"funny|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040723; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fwb.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fwb|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040724; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fwb.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fwb|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040725; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fwmo.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fwmo|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040726; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fwmo.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fwmo|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040727; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fy.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fy|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040728; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain fza.marsbrother.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"fza|03|marsbrother|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040729; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain gaca.infobusinessus.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"gaca|03|infobusinessus|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040730; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain gaca.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"gaca|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040731; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain game.aoldaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"game|03|aoldaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040732; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain game.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"game|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040733; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain games.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"games|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040734; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain gannett.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"gannett|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040735; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain gatu.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"gatu|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040736; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain gayi.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"gayi|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040737; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain gee.safalife.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"gee|03|safalife|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040738; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain gege.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"gege|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040739; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain gege.oplaymagzine.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"gege|03|oplaymagzine|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040740; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain geneticmedicine.conferencesinfo.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"geneticmedicine|03|conferencesinfo|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040741; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain geo.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"geo|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040742; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain geology.e-cardsshop.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"geology|03|e-cardsshop|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040743; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain geology.pop-musicsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"geology|03|pop-musicsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040744; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain gg.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"gg|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040745; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain gg.infobusinessus.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"gg|03|infobusinessus|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040746; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ghma.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ghma|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040747; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain gjjr.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"gjjr|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040748; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain gjmy.comrepair.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"gjmy|03|comrepair|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040749; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain gl.gmailboxes.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"gl|03|gmailboxes|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040750; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain glj.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"glj|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040751; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain global.pop-musicsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"global|03|pop-musicsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040752; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain global.softsolutionbox.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"global|03|softsolutionbox|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040753; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain globalization.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"globalization|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040754; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain glx.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"glx|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040755; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain gmail.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"gmail|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040756; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain gmail.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"gmail|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040757; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain gmail.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"gmail|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040758; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain google.applesoftupdate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"google|03|applesoftupdate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040759; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain goverment.usabbs.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"goverment|03|usabbs|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040760; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain green.safalife.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"green|03|safalife|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040761; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ground.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ground|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040762; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ground.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ground|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040763; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ground.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ground|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040764; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain gsti.busketball.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"gsti|03|busketball|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040765; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain gsup.infobusinessus.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"gsup|03|infobusinessus|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040766; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain half.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"half|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040767; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain half.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"half|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040768; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain happy.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"happy|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040769; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain happy.e-cardsshop.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"happy|03|e-cardsshop|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040770; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain happy.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"happy|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040771; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain happy.nationtour.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"happy|03|nationtour|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040772; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain happyfish.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"happyfish|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040773; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain hav.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"hav|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040774; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain health.jobsadvanced.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"health|03|jobsadvanced|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040775; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain hello.mediaxsds.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"hello|03|mediaxsds|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040776; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain help.advanbusiness.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"help|03|advanbusiness|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040777; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain help.applesoftupdate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"help|03|applesoftupdate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040778; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain help.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"help|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040779; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain help.gmailboxes.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"help|03|gmailboxes|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040780; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain help.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"help|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040781; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain help.reutersnewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"help|03|reutersnewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040782; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain help.thehealthmood.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"help|03|thehealthmood|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040783; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain hi.bpyoyo.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"hi|03|bpyoyo|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040784; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain hill.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"hill|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040785; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain hill.booksonlineclub.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"hill|03|booksonlineclub|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040786; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain hill.businessformars.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"hill|03|businessformars|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040787; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain hill.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"hill|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040788; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain hm.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"hm|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040789; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain home.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"home|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040790; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain home.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"home|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040791; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain home.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"home|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040792; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain home.reutersnewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"home|03|reutersnewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040793; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain home.staycools.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"home|03|staycools|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040794; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain hon.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"hon|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040795; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain host.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"host|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040796; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain host.issnbgkit.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"host|03|issnbgkit|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040797; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain host.regicsgf.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"host|03|regicsgf|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040798; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain hostname.regicsgf.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"hostname|03|regicsgf|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040799; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain hot.thehealthmood.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"hot|03|thehealthmood|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040800; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain hotel.safalife.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"hotel|03|safalife|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040801; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain house.globalowa.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"house|03|globalowa|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040802; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain house.gmailboxes.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"house|03|gmailboxes|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040803; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain house.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"house|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040804; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain housew.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"housew|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040805; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain hpd.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"hpd|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040806; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain hq.lksoftvc.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"hq|03|lksoftvc|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040807; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain hrsy.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"hrsy|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040808; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain https.lksoftvc.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"https|03|lksoftvc|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040809; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain https.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"https|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040810; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain https.progammerli.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"https|03|progammerli|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040811; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain hu.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"hu|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040812; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain hun.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"hun|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040813; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain hy.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"hy|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040814; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain hy.worthhummer.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"hy|03|worthhummer|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040815; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain iabk.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"iabk|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040816; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain iabk.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"iabk|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040817; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain iai.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"iai|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040818; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain iamge.usabbs.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"iamge|03|usabbs|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040819; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain idtheft.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"idtheft|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040820; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain iea.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"iea|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040821; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain iexchangefxn.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"iexchangefxn|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040822; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ifc.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ifc|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040823; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain image.aunewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"image|03|aunewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040824; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain image.satellitebbs.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"image|03|satellitebbs|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040825; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain image.todayusa.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"image|03|todayusa|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040826; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain image.usabbs.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"image|03|usabbs|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040827; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain image.usnewssite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"image|03|usnewssite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040828; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain images.spmiller.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"images|03|spmiller|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040829; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain important.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"important|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040830; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain index.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"index|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040831; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain india.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"india|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040832; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain indian.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"indian|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040833; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain indian.e-cardsshop.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"indian|03|e-cardsshop|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040834; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain indonesia.newsonlinesite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"indonesia|03|newsonlinesite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040835; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain info.aoldaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"info|03|aoldaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040836; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain info.applesoftupdate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"info|03|applesoftupdate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040837; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain info.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"info|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040838; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain info.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"info|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040839; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain info.companyinfosite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"info|03|companyinfosite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040840; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain info.defenceonline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"info|03|defenceonline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040841; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain info.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"info|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040842; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain info.freshreaders.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"info|03|freshreaders|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040843; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain info.idirectech.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"info|03|idirectech|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040844; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain info.mcafeepaying.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"info|03|mcafeepaying|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040845; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain info.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"info|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040846; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain info.newspappers.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"info|03|newspappers|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040847; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain info.rssadvanced.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"info|03|rssadvanced|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040848; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain info.saltlakenews.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"info|03|saltlakenews|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040849; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain info.softsolutionbox.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"info|03|softsolutionbox|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040850; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain info.symanteconline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"info|03|symanteconline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040851; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain info.theagenews.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"info|03|theagenews|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040852; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain info.thehealthmood.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"info|03|thehealthmood|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040853; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain info.usapappers.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"info|03|usapappers|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040854; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain info.usnewssite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"info|03|usnewssite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040855; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain information.aunewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"information|03|aunewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040856; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain information.cnndaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"information|03|cnndaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040857; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain information.defenceonline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"information|03|defenceonline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040858; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain information.downloadsite.me"; flow:to_server; byte_test:1,!&,0xF8,2; content:"information|03|downloadsite|03|me|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040859; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain information.jobsadvanced.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"information|03|jobsadvanced|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040860; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ins.globalowa.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ins|03|globalowa|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040861; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain insat.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"insat|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040862; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain int.busketball.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"int|03|busketball|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040863; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain int.freshreaders.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"int|03|freshreaders|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040864; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain intel.busketball.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"intel|03|busketball|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040865; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain intel.gmailboxes.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"intel|03|gmailboxes|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040866; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain intel.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"intel|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040867; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain inter.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"inter|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040868; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain international.canadatvsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"international|03|canadatvsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040869; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain invest.gmailboxes.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"invest|03|gmailboxes|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040870; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ips.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ips|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040871; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain iri.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"iri|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040872; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain iri.worthhummer.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"iri|03|worthhummer|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040873; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain irl.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"irl|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040874; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain irs.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"irs|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040875; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain irs.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"irs|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040876; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain irsauctions.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"irsauctions|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040877; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain irssales.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"irssales|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040878; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain iscu.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"iscu|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040879; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain iswb.softsolutionbox.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"iswb|03|softsolutionbox|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040880; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain it.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"it|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040881; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain it.newsonlinesite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"it|03|newsonlinesite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040882; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain itau.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"itau|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040883; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain itinfo.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"itinfo|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040884; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain japan.yahoodaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"japan|03|yahoodaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040885; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain java.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"java|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040886; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain jbei.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"jbei|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040887; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain jeff.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"jeff|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040888; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain jeph.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"jeph|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040889; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain jf.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"jf|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040890; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain jfn.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"jfn|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040891; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain jfs.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"jfs|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040892; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain jhd.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"jhd|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040893; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain jhd.safalife.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"jhd|03|safalife|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040894; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain jhsfkjlhjsf.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"jhsfkjlhjsf|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040895; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain job.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"job|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040896; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain job.jobsadvanced.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"job|03|jobsadvanced|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040897; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain job.yahoodaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"job|03|yahoodaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040898; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain jobs.mediaxsds.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"jobs|03|mediaxsds|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040899; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain johnford985.appspot.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"johnford985|03|appspot|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040900; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain jr.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"jr|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040901; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain juda.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"juda|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040902; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain jwss.infobusinessus.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"jwss|03|infobusinessus|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040903; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain kf.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"kf|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040904; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain khoda.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"khoda|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040905; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain king-kl.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"king-kl|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040906; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain kit.dnsweb.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"kit|03|dnsweb|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040907; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain kit.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"kit|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040908; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain klape.globalowa.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"klape|03|globalowa|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040909; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain klati.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"klati|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040910; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain klbakerm.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"klbakerm|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040911; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain klbar.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"klbar|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040912; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain klbis.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"klbis|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040913; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain klbis.globalowa.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"klbis|03|globalowa|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040914; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain klbis.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"klbis|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040915; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain kl-care.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"kl-care|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040916; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain klcirf.worthhummer.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"klcirf|03|worthhummer|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040917; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain klcocon.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"klcocon|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040918; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain klecca.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"klecca|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040919; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain klecca.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"klecca|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040920; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain klenvi.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"klenvi|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040921; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain kl-hqun.gmailboxes.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"kl-hqun|03|gmailboxes|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040922; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain kl-hqun.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"kl-hqun|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040923; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain kliee.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"kliee|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040924; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain kl-knab.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"kl-knab|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040925; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain kllhd.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"kllhd|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040926; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain kllhd.globalowa.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"kllhd|03|globalowa|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040927; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain kl-mfa.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"kl-mfa|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040928; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain klmfat.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"klmfat|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040929; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain klnrdc.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"klnrdc|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040930; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain klnrdc.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"klnrdc|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040931; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain klotp.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"klotp|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040932; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain klpiec.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"klpiec|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040933; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain kl-rfc.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"kl-rfc|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040934; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain kl-rio.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"kl-rio|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040935; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain kluscc.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"kluscc|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040936; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain kl-vfw.globalowa.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"kl-vfw|03|globalowa|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040937; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain klwest.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"klwest|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040938; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain knab.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"knab|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040939; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain knews.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"knews|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040940; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain koa.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"koa|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040941; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ks.aoldaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ks|03|aoldaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040942; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ks.aunewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ks|03|aunewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040943; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ks.cnndaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ks|03|cnndaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040944; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ks.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ks|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040945; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ks.jobsadvanced.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ks|03|jobsadvanced|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040946; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ks.mcafeepaying.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ks|03|mcafeepaying|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040947; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ks.petrotdl.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ks|03|petrotdl|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040948; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ks.usnewssite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ks|03|usnewssite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040949; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ks.yahoodaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ks|03|yahoodaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040950; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ksaa.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ksaa|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040951; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ksap.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ksap|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040952; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain kshan.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"kshan|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040953; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain kusw.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"kusw|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040954; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain lab.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"lab|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040955; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain lan.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"lan|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040956; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain launch.todayusa.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"launch|03|todayusa|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040957; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain law.canoedaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"law|03|canoedaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040958; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain law.myyahoonews.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"law|03|myyahoonews|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040959; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain lawste.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"lawste|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040960; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain lawste2.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"lawste2|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040961; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain lcan.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"lcan|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040962; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain leets.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"leets|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040963; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain leon.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"leon|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040964; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain lhd.globalowa.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"lhd|03|globalowa|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040965; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain lib.freshreaders.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"lib|03|freshreaders|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040966; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain life.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"life|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040967; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain link.applesoftupdate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"link|03|applesoftupdate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040968; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain linkup.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"linkup|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040969; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain linux.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"linux|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040970; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain lion.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"lion|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040971; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain listen.pop-musicsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"listen|03|pop-musicsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040972; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain live.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"live|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040973; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain living.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"living|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040974; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ln.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ln|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040975; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain lnz.worthhummer.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"lnz|03|worthhummer|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040976; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain loading.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"loading|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040977; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain local.dnsweb.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"local|03|dnsweb|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040978; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain log.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"log|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040979; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain log.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"log|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040980; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain log.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"log|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040981; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain log.issnbgkit.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"log|03|issnbgkit|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040982; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain log.sportreadok.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"log|03|sportreadok|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040983; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain login.aolon1ine.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"login|03|aolon1ine|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040984; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain login.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"login|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040985; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain login.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"login|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040986; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain login.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"login|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040987; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain login.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"login|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040988; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain login.safalife.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"login|03|safalife|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040989; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain logo.freshreaders.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"logo|03|freshreaders|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040990; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain logo.staycools.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"logo|03|staycools|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040991; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain logo.thehealthmood.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"logo|03|thehealthmood|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040992; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain logon.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"logon|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040993; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain logs.chileexe77.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"logs|03|chileexe77|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040994; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain logs.issnbgkit.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"logs|03|issnbgkit|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040995; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain logs.pcclubddk.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"logs|03|pcclubddk|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040996; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain logs.sportreadok.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"logs|03|sportreadok|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040997; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain lone.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"lone|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040998; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain loper.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"loper|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80040999; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain lost.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"lost|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041000; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain lost.yahoodaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"lost|03|yahoodaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041001; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain love.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"love|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041002; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain love.busketball.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"love|03|busketball|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041003; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain love.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"love|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041004; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain lovecocon.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"lovecocon|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041005; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain loveit.gmailboxes.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"loveit|03|gmailboxes|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041006; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain lrl.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"lrl|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041007; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain lucie.dnsweb.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"lucie|03|dnsweb|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041008; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain lucy.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"lucy|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041009; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain lucy.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"lucy|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041010; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain lucy.booksonlineclub.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"lucy|03|booksonlineclub|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041011; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain lucy.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"lucy|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041012; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain lucy2.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"lucy2|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041013; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain lucy2.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"lucy2|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041014; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain lw.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"lw|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041015; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain lw.infobusinessus.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"lw|03|infobusinessus|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041016; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain lw.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"lw|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041017; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain lw.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"lw|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041018; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain lwave.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"lwave|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041019; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain m.cslisten.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"m|03|cslisten|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041020; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain m.ifexcel.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"m|03|ifexcel|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041021; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain macfee.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"macfee|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041022; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain magazine.downloadsite.me"; flow:to_server; byte_test:1,!&,0xF8,2; content:"magazine|03|downloadsite|03|me|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041023; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain magazine.yahoodaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"magazine|03|yahoodaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041024; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain magic.tfxdccssl.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"magic|03|tfxdccssl|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041025; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.advanbusiness.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|advanbusiness|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041026; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.aoldaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|aoldaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041027; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.applesoftupdate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|applesoftupdate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041028; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041029; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.aunewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|aunewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041030; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041031; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041032; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.canadatvsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|canadatvsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041033; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.canoedaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|canoedaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041034; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.chileexe77.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|chileexe77|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041035; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.cnndaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|cnndaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041036; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.cnndaily.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|cnndaily|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041037; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.companyinfosite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|companyinfosite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041038; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.defenceonline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|defenceonline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041039; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.downloadsite.me"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|downloadsite|03|me|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041040; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.e-cardsshop.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|e-cardsshop|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041041; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041042; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041043; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.jobsadvanced.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|jobsadvanced|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041044; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.lksoftvc.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|lksoftvc|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041045; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.mcafeepaying.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|mcafeepaying|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041046; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.micyuisyahooapis.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|micyuisyahooapis|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041047; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041048; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041049; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.newsonlinesite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|newsonlinesite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041050; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.oplaymagzine.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|oplaymagzine|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041051; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.pop-musicsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|pop-musicsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041052; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.safalife.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|safalife|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041053; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.satellitebbs.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|satellitebbs|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041054; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.softsolutionbox.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|softsolutionbox|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041055; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.symanteconline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|symanteconline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041056; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.todayusa.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|todayusa|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041057; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.usabbs.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|usabbs|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041058; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.usapappers.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|usapappers|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041059; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.usnewssite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|usnewssite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041060; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.ustvb.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|ustvb|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041061; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.voiceofman.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|voiceofman|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041062; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail.yahoodaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail|03|yahoodaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041063; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mail2.syscation.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mail2|03|syscation|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041064; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mailbbs.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mailbbs|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041065; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mails.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mails|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041066; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mailsrv.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mailsrv|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041067; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain main.busketball.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"main|03|busketball|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041068; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain man001.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"man001|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041069; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain man001.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"man001|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041070; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain map.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"map|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041071; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain maria.reutersnewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"maria|03|reutersnewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041072; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain marines.defenceonline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"marines|03|defenceonline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041073; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain max.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"max|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041074; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mc.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mc|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041075; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mcsc.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mcsc|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041076; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain me.busketball.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"me|03|busketball|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041077; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain media.aoldaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"media|03|aoldaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041078; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain media.aunewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"media|03|aunewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041079; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain media.cnndaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"media|03|cnndaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041080; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain media.jobsadvanced.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"media|03|jobsadvanced|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041081; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain media.mcafeepaying.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"media|03|mcafeepaying|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041082; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain media.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"media|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041083; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain media.usnewssite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"media|03|usnewssite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041084; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain media.yahoodaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"media|03|yahoodaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041085; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain medicine.chileexe77.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"medicine|03|chileexe77|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041086; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain medicine.yahoodaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"medicine|03|yahoodaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041087; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain meg.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"meg|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041088; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain meily.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"meily|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041089; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain memberd.booksonlineclub.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"memberd|03|booksonlineclub|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041090; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain message.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"message|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041091; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain messenger.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"messenger|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041092; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain method.ns06.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"method|03|ns06|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041093; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mfa.globalowa.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mfa|03|globalowa|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041094; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mfc.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mfc|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041095; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain micro.applesoftupdate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"micro|03|applesoftupdate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041096; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain microsoft.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"microsoft|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041097; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain milk.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"milk|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041098; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mini.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mini|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041099; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mint.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mint|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041100; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mko.busketball.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mko|03|busketball|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041101; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mlls.globalowa.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mlls|03|globalowa|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041102; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mobile.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mobile|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041103; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain money.sportreadok.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"money|03|sportreadok|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041104; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain moon.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"moon|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041105; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain moon.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"moon|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041106; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mor.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mor|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041107; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain more.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"more|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041108; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mos.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mos|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041109; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain moto.busketball.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"moto|03|busketball|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041110; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain moto.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"moto|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041111; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain moto.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"moto|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041112; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain moto1.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"moto1|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041113; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain moto2.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"moto2|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041114; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain motoa.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"motoa|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041115; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain motor.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"motor|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041116; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain movie.canadatvsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"movie|03|canadatvsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041117; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain movies.infobusinessus.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"movies|03|infobusinessus|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041118; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mpe.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mpe|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041119; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain msn.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"msn|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041120; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain music.bpyoyo.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"music|03|bpyoyo|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041121; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain music.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"music|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041122; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain music.pop-musicsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"music|03|pop-musicsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041123; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain music.todayusa.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"music|03|todayusa|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041124; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mx.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mx|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041125; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain my.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"my|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041126; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain my550.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"my550|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041127; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain myfamily.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"myfamily|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041128; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mynet.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mynet|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041129; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain myoil.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"myoil|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041130; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain mysql.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"mysql|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041131; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain na.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"na|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041132; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain na.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"na|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041133; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain nat.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"nat|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041134; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain nature.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"nature|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041135; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain nav.booksonlineclub.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"nav|03|booksonlineclub|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041136; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain navi.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"navi|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041137; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain navi.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"navi|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041138; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain nci.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"nci|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041139; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain nci.dnsweb.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"nci|03|dnsweb|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041140; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain nci.safalife.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"nci|03|safalife|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041141; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ncih.dnsweb.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ncih|03|dnsweb|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041142; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ncsc.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ncsc|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041143; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ne.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ne|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041144; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain nes.nationtour.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"nes|03|nationtour|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041145; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain net.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"net|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041146; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain net.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"net|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041147; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain new.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"new|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041148; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain new.booksonlineclub.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"new|03|booksonlineclub|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041149; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain new.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"new|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041150; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain new.globalowa.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"new|03|globalowa|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041151; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain newport.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"newport|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041152; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain newport.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"newport|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041153; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain newport.safalife.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"newport|03|safalife|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041154; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.advanbusiness.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|advanbusiness|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041155; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.aoldaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|aoldaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041156; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.aolon1ine.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|aolon1ine|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041157; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.applesoftupdate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|applesoftupdate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041158; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041159; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041160; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.booksonlineclub.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|booksonlineclub|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041161; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.bpyoyo.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|bpyoyo|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041162; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041163; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.busketball.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|busketball|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041164; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.canadatvsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|canadatvsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041165; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.canoedaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|canoedaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041166; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.chileexe77.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|chileexe77|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041167; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.cnndaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|cnndaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041168; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.cnnnewsdaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|cnnnewsdaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041169; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.defenceonline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|defenceonline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041170; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.dnsweb.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|dnsweb|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041171; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.downloadsite.me"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|downloadsite|03|me|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041172; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.e-cardsshop.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|e-cardsshop|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041173; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041174; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.freshreaders.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|freshreaders|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041175; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041176; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041177; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.issnbgkit.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|issnbgkit|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041178; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.jobsadvanced.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|jobsadvanced|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041179; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.lksoftvc.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|lksoftvc|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041180; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.marsbrother.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|marsbrother|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041181; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.mcafeepaying.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|mcafeepaying|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041182; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.mediaxsds.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|mediaxsds|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041183; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.micyuisyahooapis.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|micyuisyahooapis|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041184; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041185; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.myyahoonews.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|myyahoonews|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041186; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.nationtour.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|nationtour|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041187; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.newsonlinesite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|newsonlinesite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041188; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.newspappers.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|newspappers|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041189; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.nytimesnews.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|nytimesnews|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041190; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.pcclubddk.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|pcclubddk|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041191; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.pop-musicsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|pop-musicsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041192; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.reutersnewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|reutersnewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041193; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.rssadvanced.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|rssadvanced|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041194; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.safalife.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|safalife|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041195; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.saltlakenews.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|saltlakenews|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041196; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.satellitebbs.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|satellitebbs|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041197; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.softsolutionbox.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|softsolutionbox|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041198; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.sportreadok.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|sportreadok|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041199; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.staycools.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|staycools|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041200; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.symanteconline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|symanteconline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041201; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.thehealthmood.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|thehealthmood|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041202; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.todayusa.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|todayusa|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041203; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.usapappers.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|usapappers|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041204; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.voiceofman.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|voiceofman|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041205; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.yahoo.com.conferencesinfo.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|yahoo|03|com|03|conferencesinfo|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041206; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain news.yahoodaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"news|03|yahoodaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041207; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain newstar.nytimesnews.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"newstar|03|nytimesnews|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041208; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain newstar.reutersnewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"newstar|03|reutersnewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041209; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain newstime.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"newstime|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041210; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain newyork.usabbs.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"newyork|03|usabbs|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041211; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ngc.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ngc|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041212; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ngng.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ngng|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041213; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain nh.microsoft-update-info.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"nh|03|microsoft-update-info|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041214; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain nhc.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"nhc|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041215; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain nhs.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"nhs|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041216; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain nhs1.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"nhs1|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041217; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain nhs1.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"nhs1|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041218; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain nhsl.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"nhsl|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041219; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain nic.safalife.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"nic|03|safalife|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041220; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain nicenews.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"nicenews|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041221; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain night.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"night|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041222; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain nis.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"nis|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041223; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain nl.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"nl|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041224; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain nod.downloadsite.me"; flow:to_server; byte_test:1,!&,0xF8,2; content:"nod|03|downloadsite|03|me|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041225; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain nol.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"nol|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041226; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain norin.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"norin|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041227; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain notebook.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"notebook|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041228; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain nousage.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"nousage|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041229; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain nrfn.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"nrfn|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041230; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ns.issnbgkit.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ns|03|issnbgkit|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041231; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain nt.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"nt|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041232; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain nucor001.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"nucor001|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041233; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain nukor001.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"nukor001|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041234; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain nullmx.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"nullmx|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041235; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain num.safalife.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"num|03|safalife|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041236; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain o.ifexcel.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"o|03|ifexcel|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041237; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain object.todayusa.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"object|03|todayusa|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041238; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain office.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"office|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041239; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain okie.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"okie|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041240; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain old.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"old|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041241; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain oliver.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"oliver|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041242; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain once.downloadsite.me"; flow:to_server; byte_test:1,!&,0xF8,2; content:"once|03|downloadsite|03|me|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041243; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain onk.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"onk|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041244; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain online.livemymsn.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"online|03|livemymsn|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041245; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain online.mcafeepaying.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"online|03|mcafeepaying|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041246; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain online.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"online|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041247; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain online.pop-musicsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"online|03|pop-musicsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041248; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain online.reutersnewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"online|03|reutersnewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041249; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ope.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ope|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041250; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain opp.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"opp|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041251; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain oppa.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"oppa|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041252; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain opts.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"opts|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041253; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain orca.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"orca|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041254; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ord.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ord|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041255; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain orient.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"orient|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041256; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain otp.blackberrycluter.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"otp|03|blackberrycluter|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041257; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain otps.globalowa.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"otps|03|globalowa|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041258; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ou.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ou|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041259; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ou1.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ou1|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041260; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ou1.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ou1|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041261; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ou2.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ou2|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041262; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ou2.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ou2|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041263; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ou3.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ou3|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041264; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ou4.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ou4|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041265; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ou5.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ou5|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041266; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ou6.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ou6|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041267; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ou7.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ou7|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041268; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain outlook.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"outlook|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041269; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain outlooks.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"outlooks|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041270; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain owa.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"owa|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041271; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain owa.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"owa|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041272; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain owa.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"owa|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041273; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain owa.softsolutionbox.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"owa|03|softsolutionbox|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041274; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pacific.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pacific|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041275; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pacific.worthhummer.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pacific|03|worthhummer|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041276; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pack.cnnnewsdaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pack|03|cnnnewsdaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041277; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pact.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pact|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041278; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain paekl.gmailboxes.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"paekl|03|gmailboxes|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041279; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain papper.booksonlineclub.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"papper|03|booksonlineclub|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041280; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain papper.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"papper|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041281; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pars.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pars|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041282; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain part.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"part|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041283; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain part.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"part|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041284; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain parth.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"parth|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041285; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pay.aunewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pay|03|aunewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041286; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pay.freshreaders.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pay|03|freshreaders|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041287; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain payse.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"payse|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041288; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pcie.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pcie|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041289; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pda.applesoftupdate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pda|03|applesoftupdate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041290; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pda.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pda|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041291; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pda.reutersnewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pda|03|reutersnewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041292; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pda.staycools.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pda|03|staycools|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041293; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pda.usapappers.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pda|03|usapappers|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041294; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pdoc.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pdoc|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041295; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pear.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pear|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041296; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pear.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pear|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041297; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pear.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pear|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041298; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain people.softsolutionbox.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"people|03|softsolutionbox|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041299; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain phb.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"phb|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041300; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain phe.reutersnewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"phe|03|reutersnewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041301; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain philippines.cnndaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"philippines|03|cnndaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041302; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pic.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pic|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041303; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain picture.chileexe77.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"picture|03|chileexe77|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041304; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pink.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pink|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041305; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain plane.usabbs.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"plane|03|usabbs|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041306; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain planning.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"planning|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041307; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain play.conferencesinfo.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"play|03|conferencesinfo|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041308; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain play.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"play|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041309; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pme.worthhummer.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pme|03|worthhummer|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041310; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain png.sportreadok.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"png|03|sportreadok|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041311; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop.advanbusiness.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop|03|advanbusiness|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041312; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop.aoldaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop|03|aoldaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041313; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop.applesoftupdate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop|03|applesoftupdate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041314; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop.aunewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop|03|aunewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041315; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041316; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041317; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop.canadatvsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop|03|canadatvsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041318; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop.canoedaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop|03|canoedaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041319; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop.cnndaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop|03|cnndaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041320; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop.cnndaily.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop|03|cnndaily|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041321; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop.companyinfosite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop|03|companyinfosite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041322; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop.defenceonline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop|03|defenceonline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041323; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop.dnsweb.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop|03|dnsweb|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041324; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop.downloadsite.me"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop|03|downloadsite|03|me|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041325; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop.e-cardsshop.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop|03|e-cardsshop|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041326; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041327; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041328; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop.jobsadvanced.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop|03|jobsadvanced|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041329; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop.mcafeepaying.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop|03|mcafeepaying|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041330; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop.micyuisyahooapis.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop|03|micyuisyahooapis|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041331; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041332; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop.newsonlinesite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop|03|newsonlinesite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041333; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop.pop-musicsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop|03|pop-musicsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041334; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop.satellitebbs.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop|03|satellitebbs|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041335; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop.staycools.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop|03|staycools|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041336; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop.symanteconline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop|03|symanteconline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041337; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop.todayusa.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop|03|todayusa|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041338; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop.usabbs.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop|03|usabbs|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041339; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop.usapappers.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop|03|usapappers|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041340; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop.usnewssite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop|03|usnewssite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041341; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop.voiceofman.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop|03|voiceofman|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041342; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop.yahoodaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop|03|yahoodaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041343; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop2.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop2|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041344; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop2.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop2|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041345; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop3.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop3|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041346; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop3.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop3|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041347; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop4.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop4|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041348; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop5.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop5|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041349; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop6.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop6|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041350; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pop9.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pop9|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041351; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain popw.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"popw|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041352; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain popwk.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"popwk|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041353; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain portbab.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"portbab|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041354; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain portpop.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"portpop|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041355; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ppt.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ppt|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041356; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain prc.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"prc|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041357; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain prefix.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"prefix|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041358; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain prefix.usapappers.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"prefix|03|usapappers|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041359; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pro.reutersnewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pro|03|reutersnewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041360; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain proc.blackberrycluter.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"proc|03|blackberrycluter|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041361; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain proc.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"proc|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041362; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain product.satellitebbs.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"product|03|satellitebbs|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041363; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain program.reutersnewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"program|03|reutersnewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041364; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain progress.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"progress|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041365; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain protoc.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"protoc|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041366; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain psp.advanbusiness.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"psp|03|advanbusiness|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041367; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain psp.staycools.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"psp|03|staycools|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041368; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain psu.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"psu|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041369; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain psu.nytimesnews.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"psu|03|nytimesnews|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041370; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain psu.worthhummer.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"psu|03|worthhummer|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041371; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ptp.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ptp|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041372; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain pz.booksonlineclub.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"pz|03|booksonlineclub|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041373; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain qedh.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"qedh|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041374; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain qhun-mons.businessformars.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"qhun-mons|03|businessformars|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041375; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain qiao1.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"qiao1|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041376; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain qiao1.safalife.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"qiao1|03|safalife|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041377; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain qiao2.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"qiao2|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041378; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain qiao3.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"qiao3|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041379; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain qiao4.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"qiao4|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041380; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain qiao5.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"qiao5|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041381; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain qiao6.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"qiao6|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041382; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain qiao7.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"qiao7|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041383; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain qiao8.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"qiao8|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041384; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain qua.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"qua|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041385; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain qual.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"qual|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041386; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain quick.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"quick|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041387; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain quiet.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"quiet|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041388; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain qusc12.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"qusc12|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041389; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain rank.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"rank|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041390; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain rcs.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"rcs|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041391; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain reas.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"reas|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041392; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain record.companyinfosite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"record|03|companyinfosite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041393; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain records.marsbrother.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"records|03|marsbrother|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041394; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain red.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"red|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041395; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain red.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"red|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041396; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain reg.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"reg|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041397; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain release.busketball.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"release|03|busketball|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041398; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain release.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"release|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041399; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain release.softsolutionbox.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"release|03|softsolutionbox|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041400; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain report.cnnnewsdaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"report|03|cnnnewsdaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041401; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain report.regicsgf.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"report|03|regicsgf|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041402; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain reports.saltlakenews.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"reports|03|saltlakenews|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041403; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain research.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"research|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041404; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain research.softsolutionbox.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"research|03|softsolutionbox|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041405; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain rice.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"rice|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041406; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain rj.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"rj|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041407; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain rj.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"rj|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041408; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain rnew.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"rnew|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041409; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain roger.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"roger|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041410; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain root.newspappers.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"root|03|newspappers|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041411; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain root.saltlakenews.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"root|03|saltlakenews|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041412; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain rou.pop-musicsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"rou|03|pop-musicsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041413; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain rsut.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"rsut|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041414; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain s.ifexcel.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"s|03|ifexcel|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041415; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain s.microsoft-update-info.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"s|03|microsoft-update-info|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041416; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain saf.blackberrycluter.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"saf|03|blackberrycluter|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041417; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain saf.globalowa.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"saf|03|globalowa|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041418; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain safbejn.worthhummer.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"safbejn|03|worthhummer|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041419; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain safe.canadatvsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"safe|03|canadatvsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041420; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain safe.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"safe|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041421; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain safety.canadatvsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"safety|03|canadatvsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041422; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain safety.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"safety|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041423; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain safety.newsonlinesite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"safety|03|newsonlinesite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041424; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain safr.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"safr|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041425; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sale.advanbusiness.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sale|03|advanbusiness|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041426; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sale.staycools.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sale|03|staycools|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041427; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sales.usnewssite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sales|03|usnewssite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041428; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sam.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sam|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041429; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sam.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sam|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041430; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sam.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sam|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041431; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain satellite.yahoodaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"satellite|03|yahoodaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041432; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sauu.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sauu|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041433; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sav.safalife.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sav|03|safalife|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041434; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sb.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sb|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041435; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sbh.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sbh|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041436; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain scc.globalowa.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"scc|03|globalowa|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041437; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain scc.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"scc|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041438; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain science.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"science|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041439; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain scorpion.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"scorpion|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041440; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain scpkl.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"scpkl|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041441; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sea.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sea|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041442; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sea001.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sea001|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041443; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain search.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"search|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041444; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain search.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"search|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041445; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain search.searchforca.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"search|03|searchforca|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041446; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain security.canadatvsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"security|03|canadatvsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041447; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain security.mcafeepaying.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"security|03|mcafeepaying|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041448; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain security.nationtour.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"security|03|nationtour|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041449; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain security.symanteconline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"security|03|symanteconline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041450; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain self.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"self|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041451; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sells.aunewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sells|03|aunewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041452; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sells.usnewssite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sells|03|usnewssite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041453; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain send.issnbgkit.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"send|03|issnbgkit|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041454; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain serv.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"serv|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041455; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain serve.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"serve|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041456; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain server.applesoftupdate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"server|03|applesoftupdate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041457; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain service.applesoftupdate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"service|03|applesoftupdate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041458; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain service.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"service|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041459; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain service.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"service|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041460; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain service.issnbgkit.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"service|03|issnbgkit|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041461; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain service.symanteconline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"service|03|symanteconline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041462; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain services.busketball.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"services|03|busketball|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041463; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain services.gmailboxes.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"services|03|gmailboxes|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041464; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain servmail.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"servmail|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041465; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain servmailb.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"servmailb|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041466; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain servmails.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"servmails|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041467; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain set.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"set|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041468; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sfn.globalowa.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sfn|03|globalowa|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041469; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sh.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sh|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041470; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain share.aoldaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"share|03|aoldaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041471; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain share.aunewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"share|03|aunewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041472; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain share.canoedaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"share|03|canoedaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041473; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain share.jobsadvanced.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"share|03|jobsadvanced|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041474; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain share.usnewssite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"share|03|usnewssite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041475; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain shit.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"shit|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041476; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain shop.e-cardsshop.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"shop|03|e-cardsshop|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041477; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain shop.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"shop|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041478; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain shop.newsonlinesite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"shop|03|newsonlinesite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041479; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain shop.pop-musicsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"shop|03|pop-musicsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041480; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain shop.yahoodaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"shop|03|yahoodaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041481; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain shot.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"shot|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041482; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain shot.newspappers.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"shot|03|newspappers|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041483; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain shot.usapappers.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"shot|03|usapappers|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041484; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sifcc.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sifcc|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041485; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain signal.satellitebbs.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"signal|03|satellitebbs|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041486; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sinbg.comrepair.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sinbg|03|comrepair|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041487; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sisc.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sisc|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041488; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sites.progammerli.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sites|03|progammerli|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041489; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sk2.gmailboxes.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sk2|03|gmailboxes|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041490; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain skills.cnndaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"skills|03|cnndaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041491; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain skills.usnewssite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"skills|03|usnewssite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041492; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sklcenter.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sklcenter|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041493; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sky.applesoftupdate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sky|03|applesoftupdate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041494; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sky.canoedaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sky|03|canoedaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041495; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sky.downloadsite.me"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sky|03|downloadsite|03|me|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041496; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sky.safalife.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sky|03|safalife|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041497; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain slnoa.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"slnoa|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041498; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain slnoa.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"slnoa|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041499; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain slrfc.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"slrfc|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041500; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain slrj.softsolutionbox.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"slrj|03|softsolutionbox|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041501; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain slrou.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"slrou|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041502; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain slrouji.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"slrouji|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041503; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sls.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sls|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041504; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain slutc.globalowa.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"slutc|03|globalowa|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041505; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sma.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sma|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041506; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain smile.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"smile|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041507; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain smlk.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"smlk|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041508; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain smooth.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"smooth|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041509; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain smtp.advanbusiness.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"smtp|03|advanbusiness|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041510; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain smtp.aoldaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"smtp|03|aoldaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041511; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain smtp.applesoftupdate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"smtp|03|applesoftupdate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041512; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain smtp.aunewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"smtp|03|aunewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041513; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain smtp.canadatvsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"smtp|03|canadatvsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041514; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain smtp.canoedaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"smtp|03|canoedaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041515; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain smtp.cnndaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"smtp|03|cnndaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041516; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain smtp.cnndaily.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"smtp|03|cnndaily|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041517; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain smtp.companyinfosite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"smtp|03|companyinfosite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041518; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain smtp.defenceonline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"smtp|03|defenceonline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041519; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain smtp.downloadsite.me"; flow:to_server; byte_test:1,!&,0xF8,2; content:"smtp|03|downloadsite|03|me|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041520; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain smtp.e-cardsshop.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"smtp|03|e-cardsshop|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041521; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain smtp.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"smtp|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041522; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain smtp.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"smtp|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041523; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain smtp.jobsadvanced.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"smtp|03|jobsadvanced|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041524; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain smtp.mcafeepaying.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"smtp|03|mcafeepaying|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041525; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain smtp.micyuisyahooapis.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"smtp|03|micyuisyahooapis|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041526; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain smtp.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"smtp|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041527; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain smtp.newsonlinesite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"smtp|03|newsonlinesite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041528; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain smtp.pop-musicsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"smtp|03|pop-musicsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041529; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain smtp.safalife.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"smtp|03|safalife|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041530; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain smtp.satellitebbs.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"smtp|03|satellitebbs|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041531; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain smtp.symanteconline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"smtp|03|symanteconline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041532; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain smtp.todayusa.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"smtp|03|todayusa|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041533; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain smtp.usabbs.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"smtp|03|usabbs|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041534; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain smtp.usapappers.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"smtp|03|usapappers|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041535; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain smtp.usnewssite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"smtp|03|usnewssite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041536; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain smtp.voiceofman.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"smtp|03|voiceofman|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041537; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain smtp.yahoodaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"smtp|03|yahoodaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041538; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain snoopy.safalife.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"snoopy|03|safalife|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041539; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain snoot.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"snoot|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041540; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sns.syscation.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sns|03|syscation|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041541; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sns.syscation.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sns|03|syscation|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041542; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain soft.advanbusiness.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"soft|03|advanbusiness|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041543; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain soft.applesoftupdate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"soft|03|applesoftupdate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041544; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain soft.cnnnewsdaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"soft|03|cnnnewsdaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041545; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain soft.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"soft|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041546; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain soft.nytimesnews.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"soft|03|nytimesnews|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041547; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain soft.thehealthmood.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"soft|03|thehealthmood|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041548; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain software.advanbusiness.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"software|03|advanbusiness|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041549; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain software.nytimesnews.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"software|03|nytimesnews|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041550; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain solar.e-cardsshop.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"solar|03|e-cardsshop|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041551; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain solar.pop-musicsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"solar|03|pop-musicsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041552; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain solar.reutersnewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"solar|03|reutersnewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041553; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain soler.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"soler|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041554; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sona.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sona|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041555; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sonah.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sonah|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041556; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain songhong.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"songhong|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041557; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sope.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sope|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041558; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sos.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sos|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041559; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sotp.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sotp|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041560; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain source.livemymsn.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"source|03|livemymsn|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041561; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sp.booksonlineclub.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sp|03|booksonlineclub|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041562; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sp.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sp|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041563; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain space.canadatvsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"space|03|canadatvsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041564; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain spah.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"spah|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041565; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain spahi.dnsweb.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"spahi|03|dnsweb|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041566; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain spckl.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"spckl|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041567; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain spcmon.businessformars.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"spcmon|03|businessformars|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041568; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain special.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"special|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041569; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sports.aoldaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sports|03|aoldaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041570; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sports.aunewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sports|03|aunewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041571; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sports.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sports|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041572; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sports.canoedaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sports|03|canoedaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041573; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sports.chileexe77.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sports|03|chileexe77|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041574; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sports.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sports|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041575; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sports.newsonlinesite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sports|03|newsonlinesite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041576; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sports.nytimesnews.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sports|03|nytimesnews|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041577; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sports.rssadvanced.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sports|03|rssadvanced|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041578; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sports.staycools.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sports|03|staycools|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041579; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sports.thehealthmood.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sports|03|thehealthmood|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041580; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sports.todayusa.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sports|03|todayusa|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041581; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sports.usnewssite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sports|03|usnewssite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041582; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sports.voiceofman.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sports|03|voiceofman|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041583; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sports.yahoodaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sports|03|yahoodaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041584; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sports3.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sports3|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041585; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sprts.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sprts|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041586; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain spte.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"spte|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041587; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain squick.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"squick|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041588; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sremx.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sremx|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041589; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain srs.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"srs|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041590; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain srs.dnsweb.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"srs|03|dnsweb|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041591; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain srs.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"srs|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041592; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain srvmail.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"srvmail|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041593; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sslsrv1.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sslsrv1|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041594; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sslsrv2.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sslsrv2|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041595; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sslsrv5.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sslsrv5|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041596; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sslsrv5.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sslsrv5|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041597; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sslsrv6.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sslsrv6|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041598; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ssun.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ssun|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041599; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain star.canoedaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"star|03|canoedaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041600; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain star.satellitebbs.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"star|03|satellitebbs|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041601; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain star.usabbs.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"star|03|usabbs|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041602; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain stars.advanbusiness.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"stars|03|advanbusiness|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041603; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain stars.nytimesnews.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"stars|03|nytimesnews|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041604; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain static.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"static|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041605; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain stell.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"stell|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041606; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain step.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"step|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041607; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain stk.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"stk|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041608; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain stk.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"stk|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041609; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain stock.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"stock|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041610; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain stock.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"stock|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041611; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain stone.pop-musicsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"stone|03|pop-musicsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041612; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain stone.symanteconline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"stone|03|symanteconline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041613; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain stulaw.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"stulaw|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041614; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain stuwal.gmailboxes.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"stuwal|03|gmailboxes|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041615; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain stuwal.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"stuwal|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041616; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain submarine.defenceonline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"submarine|03|defenceonline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041617; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain submarine.downloadsite.me"; flow:to_server; byte_test:1,!&,0xF8,2; content:"submarine|03|downloadsite|03|me|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041618; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain suffering.e-cardsshop.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"suffering|03|e-cardsshop|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041619; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain suffering.mcafeepaying.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"suffering|03|mcafeepaying|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041620; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain suffering.nationtour.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"suffering|03|nationtour|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041621; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain suffering.pop-musicsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"suffering|03|pop-musicsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041622; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain suffering.searchforca.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"suffering|03|searchforca|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041623; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sun.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sun|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041624; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sun.newspappers.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sun|03|newspappers|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041625; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sun.usapappers.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sun|03|usapappers|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041626; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain support.advanbusiness.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"support|03|advanbusiness|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041627; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain support.applesoftupdate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"support|03|applesoftupdate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041628; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain support.companyinfosite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"support|03|companyinfosite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041629; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain support.livemymsn.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"support|03|livemymsn|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041630; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain support.mcafeepaying.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"support|03|mcafeepaying|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041631; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain support.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"support|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041632; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain support.satellitebbs.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"support|03|satellitebbs|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041633; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain support.searchforca.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"support|03|searchforca|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041634; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain support.symanteconline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"support|03|symanteconline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041635; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain support.thehealthmood.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"support|03|thehealthmood|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041636; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain support.todayusa.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"support|03|todayusa|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041637; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain support.voiceofman.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"support|03|voiceofman|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041638; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain support.webservicesupdate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"support|03|webservicesupdate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041639; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sute.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sute|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041640; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sw.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sw|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041641; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain swiss.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"swiss|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041642; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sword.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sword|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041643; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sword.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sword|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041644; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain syn.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"syn|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041645; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sync.ns06.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sync|03|ns06|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041646; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sys.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sys|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041647; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sys.newspappers.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sys|03|newspappers|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041648; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sys.usapappers.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sys|03|usapappers|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041649; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sysj.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sysj|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041650; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain system.satellitebbs.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"system|03|satellitebbs|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041651; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain sysy.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"sysy|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041652; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain tag.applesoftupdate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"tag|03|applesoftupdate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041653; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain tape.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"tape|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041654; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain tape.dnsweb.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"tape|03|dnsweb|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041655; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain tape.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"tape|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041656; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain tclient.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"tclient|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041657; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain tclient.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"tclient|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041658; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain teach.usabbs.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"teach|03|usabbs|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041659; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain tech.applesoftupdate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"tech|03|applesoftupdate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041660; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain tech.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"tech|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041661; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain tech.saltlakenews.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"tech|03|saltlakenews|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041662; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain tech.usapappers.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"tech|03|usapappers|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041663; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain tele.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"tele|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041664; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain telnet.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"telnet|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041665; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain test.bpyoyo.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"test|03|bpyoyo|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041666; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain test.chileexe77.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"test|03|chileexe77|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041667; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain test.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"test|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041668; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain test.issnbgkit.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"test|03|issnbgkit|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041669; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain test.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"test|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041670; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain test.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"test|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041671; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain thanhnien.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"thanhnien|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041672; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain thec.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"thec|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041673; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain think.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"think|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041674; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain think.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"think|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041675; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain tia.gmailboxes.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"tia|03|gmailboxes|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041676; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain time.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"time|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041677; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain time.issnbgkit.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"time|03|issnbgkit|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041678; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain time.mediaxsds.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"time|03|mediaxsds|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041679; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain time.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"time|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041680; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain time1.mediaxsds.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"time1|03|mediaxsds|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041681; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain times.nytimesnews.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"times|03|nytimesnews|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041682; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain tk.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"tk|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041683; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain tnjs.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"tnjs|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041684; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain tod.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"tod|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041685; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain top.ifexcel.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"top|03|ifexcel|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041686; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain topmoney.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"topmoney|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041687; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain train.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"train|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041688; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain train.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"train|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041689; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain travel.cnndaily.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"travel|03|cnndaily|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041690; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain travel.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"travel|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041691; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain travel.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"travel|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041692; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain travel.nationtour.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"travel|03|nationtour|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041693; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain trb.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"trb|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041694; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain trip.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"trip|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041695; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain trip.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"trip|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041696; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain triu.booksonlineclub.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"triu|03|booksonlineclub|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041697; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ts.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ts|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041698; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain tt.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"tt|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041699; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ttl.tfxdccssl.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ttl|03|tfxdccssl|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041700; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain tx.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"tx|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041701; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-aa.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-aa|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041702; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-aaon.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-aaon|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041703; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-aeai.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-aeai|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041704; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-ag.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-ag|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041705; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-asg.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-asg|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041706; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-ati.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-ati|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041707; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-bdai.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-bdai|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041708; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-bdai.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-bdai|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041709; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-bdfa.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-bdfa|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041710; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-bpd.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-bpd|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041711; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-cccc.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-cccc|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041712; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-ccr.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-ccr|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041713; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-chsaw.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-chsaw|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041714; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-co.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-co|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041715; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-cti.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-cti|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041716; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-dfait.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-dfait|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041717; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-enrc.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-enrc|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041718; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-ga.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-ga|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041719; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-hst.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-hst|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041720; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-hst.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-hst|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041721; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-irpf.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-irpf|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041722; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-kfc.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-kfc|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041723; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-man.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-man|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041724; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-mbi.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-mbi|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041725; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-nema.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-nema|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041726; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-opm.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-opm|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041727; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-piec.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-piec|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041728; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-pmet.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-pmet|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041729; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-pnl.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-pnl|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041730; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-rev.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-rev|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041731; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-rj.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-rj|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041732; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-rj.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-rj|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041733; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-sbig.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-sbig|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041734; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-tree.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-tree|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041735; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-tta.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-tta|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041736; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-volpe.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-volpe|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041737; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ug-west.hugesoft.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ug-west|03|hugesoft|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041738; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain unifh.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"unifh|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041739; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain up.bpyoyo.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"up|03|bpyoyo|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041740; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain up.safalife.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"up|03|safalife|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041741; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain upback.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"upback|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041742; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain update.advanbusiness.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"update|03|advanbusiness|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041743; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain update.aoldaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"update|03|aoldaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041744; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain update.aunewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"update|03|aunewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041745; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain update.booksonlineclub.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"update|03|booksonlineclub|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041746; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain update.busketball.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"update|03|busketball|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041747; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain update.companyinfosite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"update|03|companyinfosite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041748; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain update.defenceonline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"update|03|defenceonline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041749; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain update.dnsweb.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"update|03|dnsweb|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041750; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain update.downloadsite.me"; flow:to_server; byte_test:1,!&,0xF8,2; content:"update|03|downloadsite|03|me|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041751; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain update.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"update|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041752; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain update.freshreaders.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"update|03|freshreaders|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041753; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain update.idirectech.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"update|03|idirectech|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041754; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain update.livemymsn.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"update|03|livemymsn|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041755; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain update.lksoftvc.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"update|03|lksoftvc|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041756; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain update.mcafeepaying.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"update|03|mcafeepaying|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041757; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain update.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"update|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041758; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain update.nationtour.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"update|03|nationtour|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041759; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain update.progammerli.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"update|03|progammerli|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041760; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain update.reutersnewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"update|03|reutersnewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041761; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain update.safalife.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"update|03|safalife|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041762; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain update.satellitebbs.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"update|03|satellitebbs|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041763; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain update.searchforca.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"update|03|searchforca|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041764; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain update.staycools.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"update|03|staycools|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041765; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain update.symanteconline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"update|03|symanteconline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041766; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain update.tfxdccssl.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"update|03|tfxdccssl|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041767; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain update.thehealthmood.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"update|03|thehealthmood|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041768; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain update.todayusa.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"update|03|todayusa|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041769; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain update.usabbs.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"update|03|usabbs|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041770; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain update.yahoodaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"update|03|yahoodaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041771; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain update7.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"update7|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041772; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain update8.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"update8|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041773; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain updater.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"updater|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041774; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain updatevn.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"updatevn|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041775; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain upload.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"upload|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041776; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain u-rfc.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"u-rfc|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041777; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain url.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"url|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041778; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain url.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"url|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041779; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain us.cnndaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"us|03|cnndaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041780; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain us.issnbgkit.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"us|03|issnbgkit|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041781; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain us.rssadvanced.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"us|03|rssadvanced|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041782; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain utex.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"utex|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041783; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain value.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"value|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041784; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain vedio.reutersnewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"vedio|03|reutersnewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041785; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain velp.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"velp|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041786; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain via.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"via|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041787; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain via.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"via|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041788; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain via.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"via|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041789; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain video.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"video|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041790; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain vip.issnbgkit.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"vip|03|issnbgkit|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041791; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain vip.pcclubddk.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"vip|03|pcclubddk|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041792; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain vip.sportreadok.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"vip|03|sportreadok|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041793; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain vis.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"vis|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041794; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain visual.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"visual|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041795; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain vockl.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"vockl|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041796; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain vol.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"vol|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041797; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain vop.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"vop|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041798; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain vope.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"vope|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041799; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain vopm.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"vopm|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041800; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain vpn.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"vpn|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041801; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain vpn.businessformars.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"vpn|03|businessformars|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041802; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain vpn.globalowa.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"vpn|03|globalowa|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041803; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain vpn.softsolutionbox.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"vpn|03|softsolutionbox|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041804; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain vsec.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"vsec|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041805; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain vseh.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"vseh|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041806; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain walk.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"walk|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041807; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain walste.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"walste|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041808; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wangye.e-cardsshop.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wangye|03|e-cardsshop|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041809; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wangye.reutersnewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wangye|03|reutersnewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041810; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wapi.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wapi|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041811; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain was.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"was|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041812; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain water.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"water|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041813; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wave.pop-musicsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wave|03|pop-musicsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041814; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wcasekl.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wcasekl|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041815; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wcov.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wcov|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041816; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wdeh.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wdeh|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041817; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain weather.aunewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"weather|03|aunewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041818; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain weather.chileexe77.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"weather|03|chileexe77|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041819; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain weather.freshreaders.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"weather|03|freshreaders|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041820; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain weather.staycools.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"weather|03|staycools|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041821; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain weather.usnewssite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"weather|03|usnewssite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041822; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain weather.yahoodaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"weather|03|yahoodaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041823; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain web.advanbusiness.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"web|03|advanbusiness|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041824; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain web.applesoftupdate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"web|03|applesoftupdate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041825; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain web.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"web|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041826; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain web.companyinfosite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"web|03|companyinfosite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041827; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain web.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"web|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041828; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain web.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"web|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041829; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain web.newspappers.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"web|03|newspappers|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041830; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain web.rssadvanced.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"web|03|rssadvanced|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041831; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain web.saltlakenews.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"web|03|saltlakenews|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041832; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain web.searchforca.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"web|03|searchforca|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041833; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain web.thehealthmood.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"web|03|thehealthmood|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041834; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain web.webservicesupdate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"web|03|webservicesupdate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041835; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain webdata.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"webdata|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041836; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain webjbs.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"webjbs|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041837; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain weblog.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"weblog|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041838; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain weblog.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"weblog|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041839; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain webmail.advanbusiness.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"webmail|03|advanbusiness|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041840; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain webmail.aoldaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"webmail|03|aoldaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041841; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain webmail.applesoftupdate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"webmail|03|applesoftupdate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041842; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain webmail.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"webmail|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041843; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain webmail.aunewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"webmail|03|aunewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041844; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain webmail.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"webmail|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041845; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain webmail.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"webmail|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041846; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain webmail.canoedaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"webmail|03|canoedaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041847; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain webmail.cnndaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"webmail|03|cnndaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041848; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain webmail.companyinfosite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"webmail|03|companyinfosite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041849; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain webmail.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"webmail|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041850; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain webmail.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"webmail|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041851; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain webmail.satellitebbs.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"webmail|03|satellitebbs|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041852; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain webmail.softsolutionbox.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"webmail|03|softsolutionbox|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041853; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain webmail.todayusa.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"webmail|03|todayusa|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041854; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain webmail.usabbs.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"webmail|03|usabbs|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041855; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain webmail.usapappers.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"webmail|03|usapappers|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041856; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain webmail.usnewssite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"webmail|03|usnewssite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041857; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain webmail.ustvb.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"webmail|03|ustvb|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041858; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain webmail.worthhummer.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"webmail|03|worthhummer|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041859; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain webmail.yahoodaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"webmail|03|yahoodaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041860; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain webmailh.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"webmailh|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041861; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain webmails.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"webmails|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041862; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain webmailw.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"webmailw|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041863; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain webs.newspappers.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"webs|03|newspappers|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041864; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wed5.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wed5|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041865; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wed5.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wed5|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041866; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain week.canadatvsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"week|03|canadatvsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041867; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain week.canoedaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"week|03|canoedaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041868; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain weg.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"weg|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041869; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wehmail.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wehmail|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041870; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain west.freshreaders.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"west|03|freshreaders|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041871; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain west.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"west|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041872; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain west1.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"west1|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041873; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain westjoe.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"westjoe|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041874; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain westking.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"westking|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041875; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain westking.comrepair.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"westking|03|comrepair|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041876; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain westkl.blackberrycluter.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"westkl|03|blackberrycluter|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041877; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain westkl.worthhummer.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"westkl|03|worthhummer|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041878; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain westnew.marsbrother.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"westnew|03|marsbrother|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041879; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wfcx.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wfcx|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041880; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wff.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wff|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041881; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wgl.infobusinessus.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wgl|03|infobusinessus|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041882; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wgw.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wgw|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041883; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wh1.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wh1|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041884; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain what.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"what|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041885; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain whi.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"whi|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041886; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain windows.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"windows|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041887; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wins.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wins|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041888; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wish.e-cardsshop.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wish|03|e-cardsshop|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041889; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wk.gmailboxes.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wk|03|gmailboxes|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041890; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wmp.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wmp|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041891; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wnam.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wnam|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041892; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wnara.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wnara|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041893; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wned.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wned|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041894; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wnew.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wnew|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041895; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain woil.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"woil|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041896; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain women.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"women|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041897; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wopec.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wopec|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041898; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wopm.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wopm|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041899; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain work.canadatvsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"work|03|canadatvsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041900; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain work.canoedaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"work|03|canoedaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041901; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain work.jobsadvanced.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"work|03|jobsadvanced|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041902; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain work.satellitebbs.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"work|03|satellitebbs|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041903; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain work.todayusa.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"work|03|todayusa|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041904; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain work.yahoodaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"work|03|yahoodaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041905; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain workstation.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"workstation|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041906; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain world.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"world|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041907; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain world.nationtour.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"world|03|nationtour|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041908; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wow.newspappers.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wow|03|newspappers|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041909; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wow.saltlakenews.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wow|03|saltlakenews|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041910; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wpcs.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wpcs|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041911; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wpot.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wpot|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041912; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wpot.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wpot|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041913; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wptex.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wptex|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041914; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wpvn.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wpvn|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041915; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wpvn.softsolutionbox.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wpvn|03|softsolutionbox|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041916; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wrim.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wrim|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041917; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wsyggfw.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wsyggfw|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041918; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wtom.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wtom|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041919; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wwab.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wwab|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041920; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wwebmails.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wwebmails|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041921; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wwt.blackcake.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wwt|03|blackcake|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041922; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.advanbusiness.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|advanbusiness|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041923; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.aoldaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|aoldaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041924; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.aolon1ine.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|aolon1ine|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041925; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.applesoftupdate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|applesoftupdate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041926; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041927; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.attnpower.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|attnpower|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041928; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.aunewsonline.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|aunewsonline|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041929; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.avvmail.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|avvmail|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041930; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.bigish.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|bigish|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041931; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.bluecoate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|bluecoate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041932; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.bpyoyo.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|bpyoyo|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041933; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.businessformars.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|businessformars|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041934; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.busketball.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|busketball|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041935; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.canadatvsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|canadatvsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041936; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.canoedaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|canoedaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041937; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.cnndaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|cnndaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041938; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.cnndaily.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|cnndaily|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041939; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.cometoway.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|cometoway|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041940; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.companyinfosite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|companyinfosite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041941; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.competrip.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|competrip|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041942; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.comtoway.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|comtoway|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041943; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.conferencesinfo.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|conferencesinfo|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041944; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.copporationnews.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|copporationnews|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041945; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.defenceonline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|defenceonline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041946; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.doemarkennel.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|doemarkennel|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041947; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.downloadsite.me"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|downloadsite|03|me|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041948; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.e-cardsshop.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|e-cardsshop|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041949; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041950; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.freshreaders.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|freshreaders|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041951; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.giftnews.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|giftnews|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041952; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.globalowa.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|globalowa|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041953; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.gmailboxes.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|gmailboxes|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041954; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.hkcastte.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|hkcastte|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041955; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.hvmetal.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|hvmetal|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041956; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.idirectech.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|idirectech|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041957; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.ifexcel.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|ifexcel|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041958; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.jjpopp.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|jjpopp|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041959; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.jobsadvanced.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|jobsadvanced|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041960; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.livemymsn.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|livemymsn|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041961; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.maltempata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|maltempata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041962; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.mcafeepaying.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|mcafeepaying|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041963; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.microsoft-update-info.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|microsoft-update-info|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041964; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.micyuisyahooapis.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|micyuisyahooapis|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041965; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041966; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.myyahoonews.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|myyahoonews|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041967; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.nationtour.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|nationtour|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041968; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.newsesport.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|newsesport|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041969; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.newsonlinesite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|newsonlinesite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041970; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.newspappers.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|newspappers|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041971; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.nirvanaol.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|nirvanaol|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041972; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.olmusic100.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|olmusic100|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041973; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.online.mcafeepaying.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|online|03|mcafeepaying|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041974; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.phoenixtvus.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|phoenixtvus|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041975; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.pop-musicsite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|pop-musicsite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041976; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.rssadvanced.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|rssadvanced|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041977; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.safety-update.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|safety-update|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041978; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.satellitebbs.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|satellitebbs|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041979; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.searchforca.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|searchforca|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041980; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.shepmas.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|shepmas|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041981; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.skyswim.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|skyswim|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041982; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.staycools.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|staycools|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041983; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.symanteconline.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|symanteconline|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041984; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.syscation.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|syscation|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041985; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.syscation.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|syscation|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041986; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.tibethome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|tibethome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041987; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.todayusa.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|todayusa|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041988; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.ueopen.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|ueopen|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041989; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.usabbs.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|usabbs|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041990; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.usapappers.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|usapappers|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041991; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.ushongkong.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|ushongkong|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041992; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.ustvb.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|ustvb|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041993; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.uszzcs.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|uszzcs|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041994; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.voiceofman.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|voiceofman|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041995; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.webservicesupdate.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|webservicesupdate|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041996; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.widewebsense.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|widewebsense|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041997; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.worthhummer.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|worthhummer|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041998; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www.youipcam.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www|03|youipcam|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80041999; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www-01.marsbrother.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www-01|03|marsbrother|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042000; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www-049.businessformars.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www-049|03|businessformars|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042001; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www1.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www1|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042002; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www1.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www1|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042003; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www1.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www1|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042004; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www1.saltlakenews.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www1|03|saltlakenews|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042005; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www2.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www2|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042006; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www3.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www3|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042007; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wwwcb.newspappers.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wwwcb|03|newspappers|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042008; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain www-ctr.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"www-ctr|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042009; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wwwi.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wwwi|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042010; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain wwwt.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"wwwt|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042011; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain x-admin.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"x-admin|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042012; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain xawh.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"xawh|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042013; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain x-book.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"x-book|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042014; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain x-fmgg.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"x-fmgg|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042015; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain xinge3344.cccpan.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"xinge3344|03|cccpan|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042016; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain xinge3344.ys168.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"xinge3344|03|ys168|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042017; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain xmer.businessconsults.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"xmer|03|businessconsults|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042018; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain x-stone.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"x-stone|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042019; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain xtap.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"xtap|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042020; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain xwclient.arrowservice.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"xwclient|03|arrowservice|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042021; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain xwclient.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"xwclient|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042022; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain xwclient.newsonet.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"xwclient|03|newsonet|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042023; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain yang.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"yang|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042024; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain yang.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"yang|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042025; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain yang1.bigdepression.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"yang1|03|bigdepression|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042026; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain yang1.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"yang1|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042027; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain yang2.infosupports.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"yang2|03|infosupports|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042028; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain yard.earthsolution.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"yard|03|earthsolution|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042029; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ysb.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ysb|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042030; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ysb.purpledaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ysb|03|purpledaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042031; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain z0.booksonlineclub.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"z0|03|booksonlineclub|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042032; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain z4.booksonlineclub.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"z4|03|booksonlineclub|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042033; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain za.booksonlineclub.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"za|03|booksonlineclub|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042034; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain zapts.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"zapts|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042035; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain zc.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"zc|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042036; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain zero.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"zero|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042037; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain zh.lksoftvc.net"; flow:to_server; byte_test:1,!&,0xF8,2; content:"zh|03|lksoftvc|03|net|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042038; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain zone.aoldaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"zone|03|aoldaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042039; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain zone.canoedaily.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"zone|03|canoedaily|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042040; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain zone.companyinfosite.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"zone|03|companyinfosite|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042041; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain zone.msnhome.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"zone|03|msnhome|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042042; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain zone.searchforca.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"zone|03|searchforca|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042043; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain zone.todayusa.org"; flow:to_server; byte_test:1,!&,0xF8,2; content:"zone|03|todayusa|03|org|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042044; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 DNS request for known malware domain ztl.firefoxupdata.com"; flow:to_server; byte_test:1,!&,0xF8,2; content:"ztl|03|firefoxupdata|03|com|00|"; fast_pattern:only; reference:url,intelreport.mandiant.com/Mandiant_APT1_Report_Appendix.zip; reference:url,www.s2grupo.es;classtype:trojan-activity; sid:80042045; rev:1;)
alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 SSL certificate for known malware domain VirtuallyThere"; content:"|00ee481376f1764b6afe6d8c5e604419b10ab19ebb63808fc843c873ae774e16014e8f88f8a28c4d2eb23d6bbd2ecc1bb0c35dd6a6bc1e1a31b22784649c0bb71eb05e8296e871f6ca95cfe140bd4505942574a090ce61b98ebaedaa62d4107968ebfb31630c7b112d8fcf57a8c46cfd77c404f54684e424c6fedc3a069c3eedf9|";nocase; classtype:policy-violation; sid:80042046; rev:1;)
alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 SSL certificate for known malware domain Fake IBM"; content:"| |";nocase; classtype:policy-violation; sid:80042047; rev:1;)
alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 SSL certificate for known malware domain ALPHA"; content:"|00de6f4ae4da2b48fb2b47476b498cd1112593b56e98618410396162921728e02f1f03ab288b9f5188cc7e794e643df2d4b575c1ddbc20a51a318f8a2f1819e20542406c8e71102c1e82856fa8f75fc9458dc6ebc459805172fc9ce16395db2ef956c8b9d686845f4591d8f5510eb67616c621675a0494e4e824fb7edfd946eef9|";nocase; classtype:policy-violation; sid:80042049; rev:1;)
alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 SSL certificate for known malware domain EMAIL"; content:"|0092c0cadf95b15f4236f4a068dbb2c3ad9e9b4a47f5b40019f7ce085545347d82d8d8b1f413b3486f60ec765b471a4713b7fb91c9948966dddcfbb7820cddeb6370d5d44e38c48485e9d5d31dbc47345c8d4041f90940304c8ca9f084e1fe473dcc570ced6f154aa44b5724e1fff3fbea0550dced0f23a4356132afd33e05cc1f|";nocase; classtype:policy-violation; sid:80042050; rev:1;)
alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 SSL certificate for known malware domain LAME"; content:"|00d918496fff1b974021807c14aa5130735a8635acb14093329db1fdbcb5655eefcfc7ad62970ef40477e7eb70f8b43751d3293f9c80ebcc404e3582853a48d107a20724f828a9935c2eb220f8cc5d7524027c4a764471b3512d91811a71a30af38d8d82d8f8170b3213db657edf42061e0ecde0e498d2396ea2d95d11548b4a09|";nocase; classtype:policy-violation; sid:80042051; rev:1;)
alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 SSL certificate for known malware domain NS"; content:"|00af0510206bd0478a6d03fddec96422e1c0494f89970da8f90f54144ca394cc9d6f6b34379000ccbd2aab8b30a80b88ef73f0de2e223ff4c701ee80d2c88c849a0012cd892bf059373080523ddf6040e0252fc78ea386dbc228b83d0746a14b18a0bc0697970e4f6518950cac58b2171bba66fd2d19addc6de66fd316b3b2ccfb|";nocase; classtype:policy-violation; sid:80042052; rev:1;)
alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 SSL certificate for known malware domain SEVER"; content:"|00a738c7c743523b59c97fccbc9bfa40af4d7d8297e6e3ec69ebb744d675d5f44bbb18e2548e670e65e9b3a8c8ebff95ff4214897a317e1bb06d8f89dbcaa31bce8a6276e872b662d0dd24ef35aff03a96a1e45a1976e9514e8d0b432bfaaf364ab421881bff006ff59863f50df3f5103ca00478233c2b54410219b23578cd075b|";nocase; classtype:policy-violation; sid:80042053; rev:1;)
alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 SSL certificate for known malware domain SUR"; content:"|009960d5ab5f5257489893ed3759b3f1e67d44c7552525823c9ca79dabd77fa45664e517315a9c21e3d6e76a1165c94bd25c4549deae2d72a97f3f59f7ccff5693cda6fbeb0d150f76b878ae4e46aee59879ea4ac9e2525277088e1c0ff329e1a81c2898a8eb7610f10806d909a3e45435ba4d29c3edf9a82ce495b7f2a7894d85|";nocase; classtype:policy-violation; sid:80042054; rev:1;)
alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 SSL certificate for known malware domain AOL"; content:"|00b868c6e975c54b7327e3aa9dd9f2ba73ec865a1c893cd0375ea73e9d4884cda412191557cabafeca2e2b72705fd764ad7a6e7ec206dd993c950519f2d7288c458f91c8616e232cb82b070821b89a4a4e1270c9eb193ae0f03e72fbadb3dd5734e8188b298f33bc32e3b0e8c03a5cfae5aac217941f81e79b602a7aaabfe134e1|";nocase; classtype:policy-violation; sid:80042055; rev:1;)
alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 SSL certificate for known malware domain YAHOO"; content:"|00fcff51f118ff584943e6bb014e776413ca791c4a24d4ec131e46681de3d0acbc08d488d5625c82bd952c6649e4802fc5795ae291ef7cb79f6e576abaf513206d619cdb12b7463294784d58cf69a28243b4b905627586fc0a92215564fb036ac82e5586e868a5e9e393f84a85918999d03c5ec316dc010f9d415c7ad40d6a8a49|";nocase; classtype:policy-violation; sid:80042056; rev:1;)
alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 SSL certificate for known malware domain MOON-NIGHT"; content:"|00b441247c0123676b66ad473d23ae089ce44c2b9bff259211ae9f5573cbd78f2ce317d4e68140684acda4ba33f8f3b7e9bc7d0c511335d9a8b9bd8c8d0da628c8b6f7661de369f29e4ce403c13bae55a5c73ede801b075d0fa7a3f05060d48029125f1b118c8a3de5b3adc176da0ca463a48b220d491aa0239980bd093d60dcf9|";nocase; classtype:policy-violation; sid:80042057; rev:1;)
alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"MANDIANT-S2GRUPO APT1 Unit 61398 SSL certificate for known malware domain NO-NAME"; content:"|009bccf3675c02db83d05d52053c8a6616fab25d7843916480095bc61fb6dc1f60fbe2d2150bf5463a76c54e91214d33462504287069258738011d85949f49d01c942f1e58e3492a8983c00b76534934f7855e4335a41624768d5b2a23bb5734af16742bf86444156d158b7aa64ea1d0e077b02ed4d900dd93d63da5e32bec7649|";nocase; classtype:policy-violation; sid:80042058; rev:1;)
